PAN-OS Fixes Dataplane Denial of Service in IKE and DNS Configurations
Tech GuruQuick Answer
Check IKE certificate-revocation and DNS proxy settings, apply the matching fixed PAN-OS build, and verify tunnels, DNS and service stability. Coordinate affected Prisma Access upgrades.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Inspect active IKE Gateways for certificate authentication and their Certificate Profiles for CRL or OCSP checks; also inspect enabled DNS Proxy objects. Prefer the supported update. The vendor lists disabling affected revocation checks or DNS Proxy objects as temporary mitigations, and limited Threat Prevention coverage via IDs 510051 and 510052 with content 9171-10349 or later and the specified traffic path and SSL decryption. Confirm the running build, certificate validation, tunnel recovery, DNS resolution and high-availability behavior; review dataplane failures and related telemetry.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS firewalls and affected Prisma Access releases |
|---|---|
| Advisory | CVE-2026-0329 |
| CVE | CVE-2026-0329 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 at vulnerable builds below, where certificate-authenticated IKE uses CRL or OCSP checks, or DNS Proxy is enabled. Prisma Access fixed targets are 12.1.10-h4, 11.2.7-h24 and 10.2.10-h43. Cloud NGFW and Panorama are unaffected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; PAN-OS 10.2.18-h14 for the 10.2 branch; alternate maintenance fixes are listed below; Prisma Access 12.1.10-h4, 11.2.7-h24 or 10.2.10-h43 |
| CVSS base score | 8.2 (CVSS v4.0 base score) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
Unauthenticated network traffic to or through a dataplane interface can trigger a buffer overflow and denial of service under the specified IKE certificate or DNS proxy conditions.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Inspect active IKE Gateways for certificate authentication and their Certificate Profiles for CRL or OCSP checks; also inspect enabled DNS Proxy objects.
- Remediate. Prefer the supported update. The vendor lists disabling affected revocation checks or DNS Proxy objects as temporary mitigations, and limited Threat Prevention coverage via IDs 510051 and 510052 with content 9171-10349 or later and the specified traffic path and SSL decryption.
- Validate. Confirm the running build, certificate validation, tunnel recovery, DNS resolution and high-availability behavior; review dataplane failures and related telemetry.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Disabling revocation checks weakens certificate validation; disabling DNS proxy can interrupt resolution. Threat Prevention coverage is limited and depends on the vendor’s full prerequisites. Retain logs and use an approved recovery plan.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.4-h14; < 12.1.7-h12; < 12.1.10-h4 | >= 12.1.4-h14; >= 12.1.7-h12; >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.4-h24; < 11.2.7-h24; < 11.2.10-h18; < 11.2.13-h5; < 11.2.16-h2 | >= 11.2.4-h24; >= 11.2.7-h24; >= 11.2.10-h18; >= 11.2.13-h5; >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.4-h39; < 11.1.6-h41; < 11.1.7-h13; < 11.1.10-h37; < 11.1.13-h17; < 11.1.16-h5 | >= 11.1.4-h39; >= 11.1.6-h41; >= 11.1.7-h13; >= 11.1.10-h37; >= 11.1.13-h17; >= 11.1.16-h5 |
| PAN-OS 10.2 | < 10.2.7-h40; < 10.2.10-h43; < 10.2.13-h28; < 10.2.16-h13; < 10.2.18-h14 | >= 10.2.7-h40; >= 10.2.10-h43; >= 10.2.13-h28; >= 10.2.16-h13; >= 10.2.18-h14 |
| Prisma Access 12.1 | < 12.1.10-h4* | >= 12.1.10-h4* |
| Prisma Access 11.2 | < 11.2.7-h24* | >= 11.2.7-h24* |
| Prisma Access 10.2 | < 10.2.10-h43* | >= 10.2.10-h43* |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
