OTPulse

PAN-OS: Denial of Service (DoS) on Panorama

Plan PatchCVSS 8.2CVE-2026-0318Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in Panorama entering maintenance mode. Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected.

What this means
What could happen
An attacker could crash your Panorama management appliance, forcing it into maintenance mode and preventing you from managing your Palo Alto firewalls across your network until the system is recovered.
Who's at risk
Organizations using Palo Alto Networks Panorama as a centralized management platform should care. This includes any entity using Panorama to manage multiple firewalls across their network. Cloud NGFW and standalone PAN-OS firewalls are not affected, only Panorama appliances.
How it could be exploited
An attacker with network access to Panorama's log processing interface can send specially crafted log data that overflows a buffer, causing the Panorama process to crash. Repeated exploitation forces Panorama into maintenance mode, denying management access to all connected firewalls.
Prerequisites
  • Network access to Panorama's log processing interface or management interface
  • No authentication required (vulnerable log processing endpoint)
  • Knowledge of buffer overflow payload structure
remotely exploitableno authentication requiredaffects centralized management capabilitylow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.4 on Panorama12.2.4 on Panorama+
Prisma AccessBelow 12.1.4-h12 on Panorama12.1.4-h12 on Panorama+
Prisma AccessBelow 12.1.7-h8 on Panorama12.1.7-h8 on Panorama+
Prisma AccessBelow 12.1.10-h2 on Panorama12.1.10-h2 on Panorama+
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDRestrict network access to Panorama to only known good IP addresses using firewall rules or network segmentation
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later on all Panorama appliances
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.4-h12 or later if running on Panorama
HOTFIXUpdate Prisma Access to version 12.1.7-h8 or later if running on Panorama
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later if running on Panorama
View full vendor advisory
API: /api/v1/advisories/ca260754-7a2c-445d-8a96-cbee86e93192

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.