What’s Vulnerable › Vulnerabilities

CVE-2026-0263: PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-10-26
• Weakness: CWE-787

Description

A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.

Affected products

• Palo Alto Networks PAN-OS: from 11.1.0 before 11.1.4; from 11.1.5 before 11.1.6; from 11.1.8 before 11.1.10; from 11.1.11 before 11.1.13; from 11.2.0 before 11.2.4; from 11.2.5 before 11.2.7 — fixed in 11.1.4, 11.1.6, 11.1.10, 11.1.13, 11.2.4, 11.2.7
• Palo Alto Networks PAN-OS: from 12.1.0 before 12.1.7, 12.1.4-h5; from 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; from 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 — fixed in 12.1.7, 12.1.4-h5, 12.1.4-h5, 12.1.7, 11.2.12, 11.2.10-h6

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 11.1.4, 11.1.6, 11.1.10, 11.1.13; Palo Alto Networks PAN-OS 12.1.7, 12.1.4-h5, 12.1.4-h5, 12.1.7. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2026-0263

Get alerted when CVE-2026-0263 or the next vulnerability affects your stack