CVE-2026-0317

PAN-OS: Denial of Service Vulnerability

Published Oct 14, 2026 CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Description

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.

The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Palo Alto Networks

Cloud NGFW

affected

Version	Status	Constraints
`All`	unaffected	—

Palo Alto Networks

PAN-OS

unaffected

Version	Status	Constraints
`12.2.0`	affected	< 12.2.4
`12.1.0`	affected	< 12.1.10-h2
`11.2.0`	affected	< 11.2.16
`11.1.0`	affected	< 11.1.16-h3

Palo Alto Networks

Prisma Access

unknown

Version	Status	Constraints
`All`	unaffected	< 12.1.7-h8

No data.

Vendor Product Versions

Palo Alto Networks

Cloud Ngfw

Version	Status	Scheme	Platform
`[0,*]`	unaffected	generic	—

Palo Alto Networks

Pan-os

Version	Status	Scheme	Platform
`[12.2.0,12.2.4)`	affected	semver	—
`[12.1.0,12.1.10-h2)`	affected	semver	—
`[11.2.0,11.2.16)`	affected	semver	—
`[11.1.0,11.1.16-h3)`	affected	semver	—

Palo Alto Networks

Prisma Access

Version	Status	Scheme	Platform
`[0,12.1.7-h8)`	unaffected	semver	—

Remediation

Vendor Solution

VersionMinor Version RangeSuggested SolutionCloud NGFW No action required. PAN-OS 12.112.2.0 through 12.2.3-h*Upgrade to 12.2.4 or later. PAN-OS 12.112.1.2 through 12.1.10-h*Upgrade to 12.1.10-h2 or later.PAN-OS 11.211.2.0 through 11.2.15-h*Upgrade to 11.2.16 or later.PAN-OS 11.111.1.0 through 11.1.16-h*Upgrade to 11.1.16-h3 or later.All other older unsupported PAN-OS versions Upgrade to a supported fixed version. Prisma Access No action needed.

Vendor Workaround

No known workarounds exist for this issue.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.310% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-104023.html
https://security.paloaltonetworks.com/CVE-2026-0317

History

Nov 10, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-104023.html

Oct 16, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Palo Alto Networks cloud Ngfw Palo Alto Networks prisma Access
Vendors & Products		Palo Alto Networks cloud Ngfw Palo Alto Networks prisma Access

Oct 15, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 14, 2026 8:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.
Title		PAN-OS: Denial of Service Vulnerability
First Time appeared		Palo Alto Networks Palo Alto Networks pan-os
Weaknesses		CWE-754
CPEs		cpe:2.3:o:palo_alto_networks:pan-os:::::::: cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:::::: cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:::::: cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:::::: cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:::::::* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:::::: cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:::::::* cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:::::::*
Vendors & Products		Palo Alto Networks Palo Alto Networks pan-os
References		https://security.paloaltonetworks.com/CVE-2026-0317
Metrics		cvssV4_0 `{'score': 1.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:L/U:Amber'}`