CVE-2026-0269: PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-10-15
Weakness: CWE-754

Description

A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4; from 11.1.5 before 11.1.6 — fixed in 10.2.7, 10.2.10, 10.2.13, 10.2.16, 11.1.4, 11.1.6
Palo Alto Networks PAN-OS: from 12.1.0 before 12.1.5; from 11.2.0 before 11.2.10; from 11.1.0 before 11.1.6-h21; from 10.2.0 before 10.2.16-h6 — fixed in 12.1.5, 12.1.4-h5, 11.2.10, 11.2.4-h17, 11.2.7-h4, 11.1.6-h21

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7, 10.2.10, 10.2.13, 10.2.16; Palo Alto Networks PAN-OS 12.1.5, 12.1.4-h5, 11.2.10, 11.2.4-h17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0269 or the next vulnerability affects your stack