PAN-OS Protocol Parsing Bug CVE-2026-0326 Requires Configuration-Level Triage

CVE-2026-0326 is a buffer overflow in PAN-OS service processing. Palo Alto Networks says an unauthenticated network attacker can disrupt a service process or corrupt memory. Panorama and Prisma Access are not affected. The vendor published the advisory on November 11, 2026 and reported no known malicious exploitation.

The base CVSS 4.0 score is 6.3, while the vendor's threat score is 1.7. The gap reflects configuration requirements and the absence of reported exploit maturity. Security teams still need to verify those conditions because the affected services can sit on the perimeter.

The three exposure paths

Palo Alto Networks lists three conditions that create exposure:

1. SCTP is enabled, or an active security rule allows SCTP traffic with an SCTP Protection profile.
2. A DNS proxy object is configured and enabled.
3. OSPFv3 routing is enabled on an IPv6 interface.

This is a useful example of why version-only vulnerability scanning is incomplete. A firewall can run an affected release but lack the configuration that exposes the vulnerable parser. A second firewall can present a smaller public footprint and still meet the condition that matters.

Affected and fixed releases

The affected PAN-OS ranges were below 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5. The corresponding fixed releases are 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5. Older unsupported branches should move to a supported fixed release.

Cloud NGFW customers are listed as affected with vendor-managed upgrades. The advisory says customers can request an earlier upgrade through support. Prisma Access customers need no action.

Temporary controls

The vendor lists configuration changes that remove the vulnerable path. Administrators can detach the SCTP Protection profile from active rules that allow SCTP traffic, disable DNS proxy objects, or review OSPFv3 exposure. These are temporary controls. They also change security policy or routing behavior, so a maintenance window and rollback plan are necessary.

Do not disable a control simply because a query reports zero public assets. The vulnerable service can be reachable from partner networks, VPN address pools, or internal segments that internet-wide measurement cannot see.

Investigation notes

Review configuration changes from the period before disclosure for unusual edits to SCTP policy, DNS proxy, and OSPFv3. Correlate firewall crashes, process restarts, and traffic anomalies with source addresses that sent malformed or unexpected protocol traffic.

A crash is not proof of exploitation. It is a signal that deserves correlation with configuration state and packet evidence. When logs are insufficient, preserve packet capture and device support files before a reboot or downgrade.

Recovery priorities

Patch first. After the upgrade, confirm that the running configuration still matches the intended policy, especially where SCTP rules or DNS proxy objects were detached during the emergency response. Re-enable services only after validating that the fixed release is active on every member of the high-availability pair.

Review whether the network accepts protocol traffic that no business service requires. SCTP and IPv6 routing should not be exposed just because the platform supports them. Keep the configuration inventory current and test it after every policy merge.

References

• Palo Alto Networks advisory for CVE-2026-0326