PAN-OS
CVE-2026-0317: PAN-OS denial of service via crafted API request
A read-only administrator can crash PAN-OS with a specially crafted API request. Rated low by Palo Alto Networks, which is not aware of any malicious exploitation.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PAN-OS 12.2.0 to 12.2.3 | 12.2.4 or later |
| PAN-OS 12.1 before 12.1.10-h2 | 12.1.10-h2 or later |
| PAN-OS 11.2.0 to 11.2.15 | 11.2.16 or later |
| PAN-OS 11.1.0 to 11.1.16-h2 | 11.1.16-h3 or later |
| Older PAN-OS (end of life) | No fix. Upgrade to a supported fixed version |
| Cloud NGFW, Panorama, Prisma Access | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
PAN-OS fails to handle an unusual condition (CWE-754) when it processes a specially crafted API request. An attacker who is logged in with a read-only administrator role can use it to cause a denial of service.
This is a low-risk bug. The attacker needs valid administrator credentials, even if only read-only, and the impact is availability only. Palo Alto Networks rates it low (CVSS-BT 1.2, CVSS-B 5.1), lists the exploit maturity as unreported, and says it is not aware of any malicious exploitation. The bug was found externally; the advisory credits Michael Messner and Benedikt Kuehne.
Am I affected?
You are affected if you run PAN-OS below the fixed version for your branch:
- 12.2: below 12.2.4
- 12.1: below 12.1.10-h2
- 11.2: below 11.2.16
- 11.1: below 11.1.16-h3
Palo Alto Networks says no special configuration is required, so every PAN-OS firewall on these versions is exposed in principle. In practice, only someone who can reach the management web interface and holds a read-only administrator account can trigger it.
Not affected: Cloud NGFW, Panorama and Prisma Access.
The advisory’s solutions table labels the 12.2 row inconsistently, but its product status table and the CVE record both give 12.2.4 as the fix.
What to do
- Upgrade to the fixed version for your branch: 12.2.4, 12.1.10-h2, 11.2.16 or 11.1.16-h3, or later. If you run an older, unsupported version, move to a supported fixed release.
- Restrict management access. Palo Alto Networks says limiting management web interface access to trusted internal IP addresses significantly reduces the risk. There is no known workaround that removes it.
- Review read-only administrator accounts. Remove any you don’t need, and make sure none are shared or have weak credentials.
This is not an emergency patch. Schedule it with your normal maintenance, sooner if the management interface is reachable from untrusted networks.
Detection
Palo Alto Networks has published no indicators and no log signatures for this issue, and reports no known exploitation. Practical checks:
- Look for unexpected firewall restarts or management plane instability, especially around logins by read-only administrator accounts.
- Review recent logins and API activity from read-only administrator accounts, and any source address outside your trusted management range.
Indicators of compromise
Checked the Palo Alto Networks advisory and a web search for the CVE ID. Palo Alto Networks reports no known exploitation.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 16 Oct 2026.