PAN-OS on Panorama (Log Collector)
CVE-2026-0318: Panorama denial of service through log processing
A stack-based buffer overflow in Panorama log processing lets a remote, unauthenticated attacker crash Panorama, and repeated attempts put it into maintenance mode. Palo Alto Networks is not aware of any exploitation.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Panorama 12.2.0 to 12.2.3 | 12.2.4 or later |
| Panorama 12.1.2 to 12.1.4-h* | 12.1.4-h12, or 12.1.10-h2 or later |
| Panorama 12.1.5 to 12.1.7-h* | 12.1.7-h8, or 12.1.10-h2 or later |
| Panorama 12.1.8 to 12.1.10-h* | 12.1.10-h2 or later |
| Panorama 11.2.0 to 11.2.4-h* | 11.2.4-h22, or 11.2.15 or later |
| Panorama 11.2.5 to 11.2.7-h* | 11.2.7-h21, or 11.2.15 or later |
| Panorama 11.2.8 to 11.2.10-h* | 11.2.10-h15, or 11.2.15 or later |
| Panorama 11.2.11 to 11.2.13-h* | 11.2.13-h3, or 11.2.15 or later |
| Panorama 11.2.14-h* | 11.2.15 or later |
| Panorama 11.1.0 to 11.1.4-h* | 11.1.4-h37, or 11.1.16-h3 or later |
| Panorama 11.1.5 to 11.1.6-h* | 11.1.6-h39, or 11.1.16-h3 or later |
| Panorama 11.1.7-h* | 11.1.7-h11, or 11.1.16-h3 or later |
| Panorama 11.1.8 to 11.1.10-h* | 11.1.10-h35, or 11.1.16-h3 or later |
| Panorama 11.1.11 to 11.1.13-h* | 11.1.13-h15, or 11.1.16-h3 or later |
| Panorama 11.1.14 to 11.1.16-h* | 11.1.16-h3 or later |
| Older PAN-OS (end of life) | No fix. Upgrade to a supported fixed version |
| Cloud NGFW, Prisma Access, standalone PAN-OS firewalls | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Panorama has a stack-based buffer overflow in its log processing. An attacker who can reach Panorama over the network can trigger it without credentials or user interaction. The result is a denial of service. If the attacker repeats it, Panorama goes into maintenance mode and stays down until you recover it.
Palo Alto Networks found the bug internally (credited to Ben Nott). It scores 8.2 on the base CVSS 4.0 scale but 4.6 (medium) with threat metrics, because exploit maturity is “unreported”. The vendor says it is not aware of malicious exploitation. The impact is availability only; the advisory lists no confidentiality or integrity impact.
The firewalls Panorama manages keep enforcing policy while Panorama is down. What you lose is management, and log collection and visibility if the Log Collector is affected.
Am I affected?
You’re exposed only if both are true:
- The device is a Panorama in Panorama mode, or in management-only mode with Log Collector, with a Collector Group configured.
- Its PAN-OS version is in the affected range (see the table above).
Not affected: Cloud NGFW, Prisma Access and standalone PAN-OS firewalls.
The advisory gives no commands or menu paths for checking the configuration. Check the version on the Panorama dashboard or with the CLI, then confirm in the web interface that a Collector Group exists. The advisory text does not name the exact menu, so confirm the location in the Panorama documentation.
show system info | match sw-version
What to do
- Upgrade Panorama to the fixed version for your branch (table above). Pick the newest build available on your branch. Branches 11.1, 11.2 and 12.1 have hotfix builds as well as later maintenance releases.
- If you can’t upgrade tonight, restrict access to Panorama so only known, trusted IP addresses can reach it. The vendor says this significantly reduces the risk. Production impact: any admin, managed device or Log Collector not on the list loses access, so check the list against your managed devices first.
- Move off end-of-life releases. There is no fix for unsupported versions.
- If Panorama has gone into maintenance mode unexpectedly, treat it as a possible attack: check who could reach it, restore service, then patch and restrict access.
Detection
Palo Alto Networks publishes no detection guidance and no indicators for this CVE. The only symptoms the advisory describes are crashes of Panorama log processing and, after repeated attempts, Panorama entering maintenance mode.
- Review Panorama system logs for unexpected restarts or maintenance-mode events.
- Check which source addresses can reach Panorama’s management interface, and look for unknown ones in your network or firewall logs.
Indicators of compromise
No exploitation is reported, so there are no indicators. Checked the Palo Alto Networks advisory only.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 16 Oct 2026.