OTPulse

PAN-OS: Denial of Service Vulnerability

MonitorCVSS 5.1CVE-2026-0317Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

A denial of service vulnerability in PAN-OS allows an authenticated user with read-only administrator role to crash the management interface by sending a specially crafted API request. The vulnerability requires valid credentials and does not affect Cloud NGFW or Panorama. Restricting management interface access to trusted internal IP addresses significantly reduces risk.

What this means
What could happen
An authenticated read-only administrator could crash the PAN-OS management interface with a crafted API request, temporarily disrupting access to firewall configuration and monitoring but not affecting active traffic forwarding.
Who's at risk
Palo Alto Networks firewall administrators managing PAN-OS and Prisma Access deployments should prioritize this issue. Organizations using these firewalls for network perimeter protection are affected if their management interfaces are accessible from untrusted networks.
How it could be exploited
An attacker with valid read-only administrator credentials and network access to the management interface (typically port 443) could send a specially crafted API request to trigger a denial of service condition on the device.
Prerequisites
  • Valid read-only administrator credentials
  • Network access to the management interface (port 443/HTTPS)
  • Access to the PAN-OS API endpoint
Requires valid credentialsManagement interface dependentLow severity (CVSS 5.1)Denial of service only—no data breach or traffic interception
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.412.2.4+
Prisma AccessBelow 12.1.10-h212.1.10-h2+
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict management interface access to only trusted internal IP addresses using firewall rules
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later
Long-term hardening
0/1
HARDENINGReview and audit read-only administrator accounts; remove unnecessary accounts
View full vendor advisory
API: /api/v1/advisories/635dcdcb-4d1a-4a20-93dc-963dd4812c6f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.