CVE-2026-0287 release notes and known issues

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

Scope: Cloud NGFW. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Panorama is not impacted by these vulnerabilities.

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

Cloud NGFW
PAN-OS
Prisma Access

Affected versions

All on AWS, All on Azure
< 12.1.4-h8, < 12.1.7-h2, < 12.1.8
< 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13
< 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16
< 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8
< 11.2.7-h18*
< 10.2.10-h39*

Fixed versions or updates

None on AWS, None on Azure
>= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8
>= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13
>= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16
>= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8
>= 11.2.7-h18*
>= 10.2.10-h39*

Recommended action

VERSION MINOR VERSION RANGE SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN-OS 11.2 11.2.11 through 11.2.12 Upgrade to 11.2.13 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h12 or 11.2.13 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h18 or 11.2.13 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h20 or 11.2.13 or later. PAN-OS 11.1 11.1.14 through 11.1.15 Upgrade to 11.1.16 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h9 or 11.1.16 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h30 or 11.1.16 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h8 or 11.1.16 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h35 or 11.1.16 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h35 or 11.1.16 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h8 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h9 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h23 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h39 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h36 or later. All other older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access 11.2 11.2.0 through 11.2.7 Upgrade to 11.2.7-h18 or later.* Prisma Access 10.2 10.2.0 through 10.2.10 Upgrade to 10.2.10-h39 or later.* * See the note under Product Status for information regarding Cloud NGFW and Prisma Access upgrades.

Related vulnerabilities

BlackTree CVE Intelligence

CVE-2026-0287Open CVE report →

Official publisher evidence

PALO ALTO NETWORKSVERIFIED

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

Checked 9 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source