CVE-2026-0310: PAN-OS: Buffer Overflow Vulnerability via XML Processing

Severity: high (CVSS 7.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-10-15
Weakness: CWE-787

Description

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.

Affected products

Palo Alto Networks Cloud NGFW: all versions
Palo Alto Networks PAN-OS: from 12.2.0 before 12.2.3; from 12.1.0 before 12.1.4-h10; from 11.2.0 before 11.2.4-h21; from 11.1.0 before 11.1.4-h36; from 10.2.0 before 10.2.7-h37 — fixed in 10.2.7-h37, 11.1.4-h36, 11.2.4-h21, 12.1.4-h10, 12.2.3
Palo Alto Networks Prisma Access: from 11.2.0 before 11.2.4-h21; from 10.2.0 before 10.2.7-h37 — fixed in 10.2.7-h37, 11.2.4-h21

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7-h37, 11.1.4-h36, 11.2.4-h21, 12.1.4-h10; Palo Alto Networks Prisma Access 10.2.7-h37, 11.2.4-h21. Check the vendor advisory for mitigations.

In the news

CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing (Severity: HIGH)

References

Get alerted when CVE-2026-0310 or the next vulnerability affects your stack