Palo Alto Networks Issues Patch for Medium-Severity PAN-OS DoS Vulnerability CVE-2026-0321
Unauthenticated attackers can trigger maintenance mode on affected firewalls by sending crafted traffic to dataplane interfaces, per the vendor advisory.
Key points
- CVE-2026-0321 allows remote denial of service via crafted network traffic on PAN-OS.
- Exploitation forces the firewall into maintenance mode rather than a simple crash.
- Updates are available for 10.2, 11.1, and 11.2 branches; 11.2.16 has an ETA.
Palo Alto Networks has released updates to address CVE-2026-0321, a medium-severity denial of service vulnerability in PAN-OS software. The flaw allows an unauthenticated attacker with network access to disrupt services by sending specially crafted traffic to or through a dataplane interface, according to the official advisory from Palo Alto Networks PSIRT.
Repeated exploitation attempts cause the firewall to enter maintenance mode, rendering it unavailable for normal traffic processing. The vendor rates the severity as medium with a suggested urgency of moderate, noting that Cloud NGFW and Panorama products are not affected by this specific issue, which targets on-premise firewall deployments.
Technical Details and Scoring
The vulnerability is associated with CWE-754, Improper Check for Unusual or Exceptional Conditions. Palo Alto Networks reports a CVSS base score of 8.7 and a temporal score of 6.6 for this issue. The company stated it is not aware of any malicious exploitation of CVE-2026-0321 in the wild, but the potential for remote disruption remains significant for unpatched systems.
No special configuration is required for a system to be affected by this vulnerability. The flaw exists in the network services handling of incoming traffic on dataplane interfaces. This follows a pattern of recent patches, including Microsoft’s October 2026 updates for .NET denial of service flaws, as reported by Threat Times on 2026-10-13, highlighting ongoing attention to resource exhaustion and service stability issues.
Affected Versions and Fixes
Multiple PAN-OS version branches are impacted by CVE-2026-0321. For the 11.2 branch, versions prior to 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, and 11
What to do and how to stay safe
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
