PAN-OS Protocol Parsing Bug CVE-2026-0326 Requires Configuration-Level Triage

CVE-2026-0326 is a buffer overflow issue in PAN-OS service processing. Unauthenticated attackers could disrupt services or corrupt memory. Panorama and Prisma Access are unaffected. The vendor disclosed the vulnerability on November 11, 2026 with no known malicious exploitation. The CVSS score is 6.3, while the threat score is 1.7, indicating the impact is limited due to configuration requirements and lack of reported exploits.

Three conditions create exposure: SCTP enabled, active security rules allowing SCTP traffic with a Protection profile, a configured and enabled DNS proxy object, or OSPFv3 routing enabled on an IPv6 interface. This highlights the need for configuration-level triage, as version-only scans can miss this. Affected PAN-OS versions are below 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5, with fixed releases matching the ranges.

Older unsupported branches should upgrade to a supported version. Cloud NGFW customers receive vendor-managed upgrades, while Prisma Access customers require no action. Temporary controls involve detaching the SCTP Protection profile, disabling DNS proxy objects, or reviewing OSPFv3 exposure, but these alter security policy or routing behavior.

The vulnerable service may be reachable from hidden networks, requiring careful investigation. Review configuration changes for unusual edits to SCTP policy, DNS proxy, and OSPFv3. Correlate firewall crashes with source addresses sending malformed protocol traffic. Preserve packet capture and device support files if logs are insufficient.

After upgrading, verify the running configuration matches the intended policy, especially regarding detached SCTP rules or DNS proxy objects. Keep the configuration inventory current and test it after policy merges.