Palo Alto Networks details low-severity PAN-OS DoS flaw for read-only admins
A new advisory reveals CVE-2026-0317 allows authenticated users with limited roles to crash PAN-OS management interfaces via crafted API requests.
Key points
- The vulnerability affects PAN-OS versions 11.1 through 12.2 but excludes Cloud NGFW, Panorama, and Prisma Access.
- Palo Alto Networks rates the issue as low severity, citing that the attacker must already have an authenticated read-only administrator account.
- No malicious exploitation of CVE-2026-0317 has been observed in the wild according to the vendor's security team.
Palo Alto Networks has published a security advisory for CVE-2026-0317, a denial of service vulnerability affecting its PAN-OS software. The flaw allows an authenticated user with a read-only administrator role to disrupt service by sending a specifically crafted API request to the management interface.
The vendor rates the security risk as low, noting that the attack requires prior authentication. According to the official advisory, the security risk is significantly minimized if organizations restrict access to the management web interface to trusted internal IP addresses, aligning with recommended best practices.
Vulnerability Scope and Mechanics
The issue stems from improper checks for unusual or exceptional conditions, classified under CWE-754. An attacker does not need special configuration on the target system to exploit this flaw. However, the requirement for a valid read-only administrator credential limits the potential impact. Palo Alto Networks states it is not aware of any malicious exploitation of this issue in the wild.
Affected Products and Versions
The vulnerability impacts a wide range of PAN-OS versions. Affected releases include 11.1.0 through 11.1.16, 11.2.0 through 11.2.15, 12.1.2 through 12.1.10, and 12.2.0 through 12.2.3. The advisory explicitly states that Cloud NGFW, Panorama, and Prisma Access are not affected by this vulnerability.
Organizations using PAN-OS 11.1.16-h3, 11.2.16, 12.1.10-h2, or 12.2.4 are not vulnerable. The vendor advises users of affected versions to review their deployment guidelines to ensure management interfaces are not exposed to untrusted networks.
What should you do?
Administrators should verify which PAN-OS versions are running in their environment. If a system falls within the affected version ranges, teams should ensure that management interfaces are accessible only from trusted internal IP addresses. This network segmentation reduces the likelihood of an attacker reaching the vulnerable API endpoint.
What to do and how to stay safe: Palo Alto Networks
- Audit your PAN-OS version inventory to identify any systems running versions 11.1 through 12.2 that are not patched.
- Verify that management web interfaces are restricted to trusted internal IP addresses to limit exposure.
- Review logs for any unusual API requests from read-only administrator accounts that could indicate testing or abuse.
- Monitor vendor communications for updates regarding this CVE once a fix is available or further guidance is issued.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-0317 being exploited in the wild?
No, Palo Alto Networks is not aware of any malicious exploitation of this issue.
Which products are not affected by this vulnerability?
Cloud NGFW, Panorama, and Prisma Access are not affected by this vulnerability.
What access level is required to exploit this flaw?
An attacker must have an authenticated user account with a read-only administrator role.
