PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
Plan PatchCVSS 8.7CVE-2026-0321Oct 14, 2026
Palo Alto NetworksTransportation
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary
Denial of service vulnerabilities in Palo Alto Networks PAN-OS allow an unauthenticated attacker with network access to cause a denial of service condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Cloud NGFW and Panorama are not affected.
What this means
What could happen
An unauthenticated attacker can send malicious network packets through your firewall to trigger a denial of service, forcing the device into maintenance mode and blocking all network traffic until manual intervention.
Who's at risk
Transportation sector organizations and any enterprise using Palo Alto Networks PAN-OS firewalls or Prisma Access for network security. This impacts network infrastructure that relies on these appliances for traffic filtering and threat prevention—if the firewall fails, all protected networks lose connectivity.
How it could be exploited
An attacker with network access to your firewall's dataplane interface sends specially crafted packets designed to crash the firewall's network services. Repeated attacks force the firewall into maintenance mode, requiring manual restart and causing a complete loss of network filtering and connectivity.
Prerequisites
- Network access to a dataplane interface of the PAN-OS firewall
- No authentication required
remotely exploitableno authentication requiredaffects network availabilityrequires manual intervention to recover
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.412.2.4+
Prisma AccessBelow 12.1.4-h1212.1.4-h12+
Prisma AccessBelow 12.1.7-h812.1.7-h8+
Prisma AccessBelow 12.1.10-h212.1.10-h2+
Remediation & Mitigation
0/5
Do now
0/1WORKAROUNDRestrict network access to dataplane interfaces to trusted sources only using network ACLs or firewall rules
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.4-h12 or later (for 12.1.4.x branch)
HOTFIXUpdate Prisma Access to version 12.1.7-h8 or later (for 12.1.7.x branch)
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later (for 12.1.10.x branch)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/9e2c2a25-57fc-4fec-bed2-50c5fc192889Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.