Palo Alto Revises Three PAN-OS Advisories With Available Fixes
Tech GuruQuick Answer
Palo Alto Networks revised CVE-2026-0317, CVE-2026-0320, and CVE-2026-0321 after additional fixed builds became available. Map each firewall, Panorama, and Prisma Access tenant to the issue-specific scope and exact branch table, deploy the supported fix, validate management and data planes, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory PA-Series, VM-Series, Panorama, and Prisma Access versions and management exposure; map each asset separately to all three advisories; install the exact branch-specific fixed build; validate management API, administrative, and network-service behavior; and review relevant telemetry.
Last verified: 2026-10-16 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS on PA-Series, VM-Series, and Panorama, plus Prisma Access where CVE-2026-0321 applies |
|---|---|
| Advisory | CVE-2026-0317 / CVE-2026-0320 / CVE-2026-0321 |
| CVEs | CVE-2026-0317, CVE-2026-0320, CVE-2026-0321 |
| Authoritative release date | 2026-10-14 16:00:00 UTC |
| Authority revision date | 2026-10-15 18:30:00 UTC |
| Affected versions | CVE-2026-0317 affects listed PAN-OS branches and excludes Panorama, Cloud NGFW, and Prisma Access; CVE-2026-0320 affects listed PAN-OS on PA-Series, VM-Series, and Panorama; CVE-2026-0321 affects listed PAN-OS and Prisma Access branches but excludes Panorama and Cloud NGFW. |
| Fixed version | the exact advisory-listed branch fix, including PAN-OS 12.2.4, 12.1.10-h2, 11.2.16, or 11.1.16-h3 where applicable, the listed older-branch hotfix, and the listed Prisma Access hotfix for CVE-2026-0321 |
| CVSS base score | 5.1 / 8.6 / 8.7 (CVSS v4.0) |
| CVSS severity | Medium to High |
| Exploitation status | Palo Alto Networks is not aware of any malicious exploitation of these issues.; no exploitation claim is inferred. |
What Changed
Palo Alto Networks published and then revised advisories for an authenticated read-only administrator denial of service, authenticated administrator command injection with root impact, and unauthenticated network-service denial of service that can place a firewall into maintenance mode. The October 15 revisions record newly available fixed builds.
What To Validate Now
- Inventory. Locate PAN-OS on PA-Series, VM-Series, and Panorama, plus Prisma Access where CVE-2026-0321 applies deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: CVE-2026-0317 affects listed PAN-OS branches and excludes Panorama, Cloud NGFW, and Prisma Access; CVE-2026-0320 affects listed PAN-OS on PA-Series, VM-Series, and Panorama; CVE-2026-0321 affects listed PAN-OS and Prisma Access branches but excludes Panorama and Cloud NGFW. Do not infer applicability from product family or severity alone.
- Remediate. Apply the exact advisory-listed branch fix, including PAN-OS 12.2.4, 12.1.10-h2, 11.2.16, or 11.1.16-h3 where applicable, the listed older-branch hotfix, and the listed Prisma Access hotfix for CVE-2026-0321 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The affected products, authentication requirements, and supported Threat Prevention controls differ across the three CVEs. Palo Alto lists no general workaround; any Threat ID control requires the documented traffic routing and SSL-decryption prerequisites. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
