PAN-OS dataplane
CVE-2026-0321: PAN-OS crafted traffic can push firewalls into maintenance mode
An unauthenticated attacker can send crafted traffic to or through a PAN-OS dataplane interface and repeatedly crash the firewall into maintenance mode. No special configuration is needed. Palo Alto Networks knows of no exploitation.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PAN-OS 12.2.0 to 12.2.3 | 12.2.4 or later |
| PAN-OS 12.1.2 to 12.1.10-h* | 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 or later (match your sub-branch) |
| PAN-OS 11.2.0 to 11.2.15-h* | 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16 or later (match your sub-branch) |
| PAN-OS 11.1.0 to 11.1.16-h* | 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3 or later (match your sub-branch) |
| PAN-OS 10.2.0 to 10.2.18-h* | 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12 or later (match your sub-branch) |
| Older PAN-OS (end of life) | No fix. Upgrade to a supported fixed version |
| Prisma Access 12.1 / 11.2 / 10.2 | 12.1.7-h8 / 11.2.7-h21 / 10.2.10-h41 or later (Palo Alto upgrades tenants in its next maintenance cycle) |
| Cloud NGFW, Panorama | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
PAN-OS fails to handle some unusual conditions in its network services (CWE-754). An unauthenticated attacker who can send crafted traffic to, or through, a dataplane interface can make the firewall fail. Palo Alto Networks says repeated attempts push the firewall into maintenance mode, which takes it out of service until someone recovers it.
This is availability-only: the advisory lists no data theft or code execution. The score is 6.6 (CVSS-BT, medium); the base score is 8.7. Because traffic through the firewall can trigger it, an attacker may not need to reach a management or portal address.
Palo Alto Networks discovered the bug internally (credit: Ben Nott). It says it is not aware of malicious exploitation, and exploit maturity is listed as unreported. No public proof of concept was found in the sources checked.
Am I affected?
Probably, if you run PAN-OS. The advisory says no special configuration is required.
- Check your version (CLI):
show system info | match sw-version
- Compare it to the table above. Fixed versions depend on your sub-branch, so match your exact release.
Not affected: Cloud NGFW and Panorama. Prisma Access is affected on 10.2, 11.2 and 12.1; Palo Alto Networks upgrades tenants in its next scheduled maintenance cycle. Ask support or your account team for an earlier window.
The advisory’s table starts PAN-OS 12.1 at 12.1.2, while the CVE record says 12.1.0. We follow the advisory.
What to do
- Upgrade to the fixed release for your branch. Pick the newest hotfix available. Users of unsupported releases must move to a supported branch.
- No workaround exists. The advisory says none is known.
- Partial mitigation: if you have a Threat Prevention subscription, enable Threat ID 510038 (Applications and Threats content 9158-10284 or later). Palo Alto Networks calls this limited coverage. It requires SSL Decryption, which may add load and privacy scope to your policy.
- Prisma Access: if you can’t wait for the maintenance cycle, contact Palo Alto Networks Support for an on-demand upgrade.
- Prioritise internet-facing firewalls, since attackers can reach their dataplane interfaces without credentials.
Detection
The advisory publishes no indicators and no log signatures, and Palo Alto Networks reports no exploitation, so there is nothing specific to hunt for. Sensible checks, none of them from the vendor:
- Unexplained firewall restarts or devices found in maintenance mode.
- If you enable Threat ID 510038, review its threat log hits.
Indicators of compromise
Checked the Palo Alto Networks advisory. It reports no known exploitation and lists no indicators.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 16 Oct 2026.