Palo Alto Networks Fixes Medium-Severity Panorama DoS in CVE-2026-0318
A buffer overflow in PAN-OS Panorama log processing can crash the system into maintenance mode, prompting urgent updates for affected versions.
Key points
- CVE-2026-0318 is a medium-severity stack-based buffer overflow in Panorama’s log processing.
- Repeated exploitation forces Panorama into maintenance mode, causing a denial of service.
- Patches are available for PAN-OS 12.1, 11.2, and 11.1 branches; standalone firewalls are safe.
Palo Alto Networks has released security updates to address a denial of service vulnerability in its Panorama management platform, identified as CVE-2026-0318. The flaw allows an attacker to crash the Panorama appliance by triggering a stack-based buffer overflow in the log processing functionality.
The vulnerability is rated medium severity with a CVSS-B score of 8.2 and a CVSS-BT score of 4.6, according to Palo Alto Networks PSIRT. Successful exploitation causes the Panorama system to enter maintenance mode after repeated attempts. The company states it is not aware of any malicious exploitation of this issue in the wild.
Context and Background
This advisory focuses specifically on the Panorama component of the PAN-OS ecosystem. The flaw is associated with CWE-754 Improper Check for Unusual or Exceptional Conditions. While the base CVSS score is 8.2, the attack requires specific preconditions, resulting in a lower base threat vector score.
The issue applies only to Panorama instances running in panorama system mode or management-only mode with a Log Collector configured. This configuration specificity limits the attack surface compared to a broader platform-wide flaw.
Who Is Affected
Standalone PAN-OS firewalls, Cloud NGFW, and Prisma Access are not affected by CVE-2026-0318. The vulnerability is isolated to Panorama appliances that meet the specific configuration criteria mentioned above. Administrators must verify their deployment mode to determine if they are at risk.
Affected versions include PAN-OS 12.1 prior to 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2. The 11.2 branch is vulnerable before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.15. The 11.1 branch is vulnerable before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3.
What should you do?
Administrators should immediately audit their Panorama appliances to check for the required Collector Group configuration. If the appliance matches the affected criteria, it should be upgraded to the latest recommended version for its branch. Until updates are applied, limiting network access to Panorama can reduce the risk of exploitation.
Palo Alto Networks advises that restricting access to Panorama to only known good IP addresses significantly reduces the risk posed by this vulnerability. This network segmentation step serves as an effective mitigation while patching is coordinated.
What to do and how to stay safe
- Verify if your Panorama appliance is running in management-only mode with a Log Collector configured.
- Check your current PAN-OS version against the list of affected releases provided in the advisory.
- Upgrade to the recommended secure version for your specific PAN-OS branch as soon as possible.
- Implement strict IP-based access controls to limit who can connect to the Panorama management interface.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
