CVE-2026-0287: 
PAN-OS vulnerability analysis and mitigation

CVE-2026-0287 describes multiple denial of service (DoS) vulnerabilities in Palo Alto Networks PAN-OS® software, Cloud NGFW, and Prisma Access. An unauthenticated attacker with network access can send specially crafted traffic to or through a dataplane interface to trigger a DoS condition; repeated exploitation causes the firewall to enter maintenance mode. Panorama is explicitly not affected. The vulnerability was discovered internally by Palo Alto Networks and publicly disclosed on July 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.6 (Medium) (PAN Advisory, GitHub Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), meaning the PAN-OS dataplane fails to properly handle malformed or unexpected network traffic. An unauthenticated attacker with network-level access can send specially crafted packets to or through a dataplane interface, causing the affected process to crash or enter an unrecoverable state. No special configuration is required for exposure — any reachable dataplane interface is a valid attack surface. Repeated triggering of the condition escalates the impact by forcing the firewall into maintenance mode, requiring manual recovery. No public proof-of-concept code or technical write-up detailing the specific packet structure has been published (PAN Advisory).

Successful exploitation results in a complete loss of availability for the affected firewall or network gateway, with no impact to confidentiality or integrity. A single exploitation attempt causes a DoS condition on the dataplane; repeated attempts force the device into maintenance mode, requiring administrator intervention to restore normal operation. Because PAN-OS firewalls and Cloud NGFW instances are typically deployed as critical network chokepoints, disruption can affect all traffic flowing through the device, potentially impacting downstream network segments and services. Prisma Access deployments have built-in resilience that partially mitigates the impact (PAN Advisory).

• Network: Unusual or malformed traffic directed at or through PAN-OS dataplane interfaces; unexpected spikes in dataplane traffic from external sources.
• Logs: PAN-OS system logs showing repeated dataplane process crashes or restarts; log entries indicating the firewall has entered or attempted to enter maintenance mode.
• System State: Firewall unexpectedly in maintenance mode requiring manual recovery; loss of traffic forwarding through the device without a known administrative cause.
• Management Alerts: Automated alerts from Panorama or monitoring systems indicating firewall unavailability or health degradation on managed devices.

Palo Alto Networks has released patched versions and states no workarounds exist for this issue. Administrators should upgrade to the following fixed versions based on their deployment branch (PAN Advisory):

• PAN-OS 10.2: 10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, 10.2.18-h8 or later
• PAN-OS 11.1: 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, 11.1.16 or later
• PAN-OS 11.2: 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, 11.2.13 or later
• PAN-OS 12.1: 12.1.4-h8, 12.1.7-h2, 12.1.8 or later
• Prisma Access 10.2: 10.2.10-h39 or later; Prisma Access 11.2: 11.2.7-h18 or later
• Cloud NGFW: Palo Alto Networks will upgrade all customers during the next scheduled maintenance cycle; customers requiring earlier upgrades should contact support.

As an interim measure, restricting untrusted network access to dataplane interfaces where operationally feasible can reduce exposure.

The vulnerability received routine coverage from security monitoring organizations including HKCERT, which published a security bulletin for Palo Alto products on July 9, 2026, and CERT GARR, which issued an alert on July 10, 2026. Social media activity was limited to automated CVE tracking accounts on Mastodon and Bluesky. No notable independent researcher commentary or significant media coverage has been identified beyond standard vulnerability aggregation and advisory republication.