PAN-OS Fixes Firewall and Session Information Disclosure
Tech GuruQuick Answer
Match firewall and cloud-service versions to the advisory, apply supported fixes and verify the running build and traffic behavior. Preserve firewall and session telemetry while reviewing potential disclosure.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Inventory PA-Series, VM-Series, Prisma Access and Cloud NGFW separately. No special firewall configuration is required; preserve the different Prisma Access access requirements. Deploy the matching fixed maintenance build. Prisma Access and Cloud NGFW updates are scheduled by Palo Alto Networks; request an earlier window through support if needed. No workaround is listed. Verify running versions and completed cloud maintenance, test representative policy and session behavior, and retain update, configuration and traffic evidence.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS PA-Series and VM-Series firewalls, Prisma Access and Cloud NGFW |
|---|---|
| Advisory | CVE-2026-0331 |
| CVE | CVE-2026-0331 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 at vulnerable builds below. Prisma Access fixed targets are 12.1.10-h4, 11.2.7-h24 and 10.2.10-h43. Cloud NGFW is listed as affected pending maintenance. Panorama is unaffected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; PAN-OS 10.2.18-h14 for the 10.2 branch; alternate maintenance fixes are listed below; Prisma Access 12.1.10-h4, 11.2.7-h24 or 10.2.10-h43; Cloud NGFW vendor maintenance |
| CVSS base score | 8.7 firewalls / 6.9 Prisma Access (CVSS v4.0 base scores) |
| CVSS severity | High (firewalls); Medium (Prisma Access) |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
Network traffic to or through an affected firewall dataplane interface can expose sensitive firewall and session information. PA-Series and VM-Series exposure is unauthenticated; the Prisma Access scenario requires an authenticated user and restricted network access.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Inventory PA-Series, VM-Series, Prisma Access and Cloud NGFW separately. No special firewall configuration is required; preserve the different Prisma Access access requirements.
- Remediate. Deploy the matching fixed maintenance build. Prisma Access and Cloud NGFW updates are scheduled by Palo Alto Networks; request an earlier window through support if needed. No workaround is listed.
- Validate. Verify running versions and completed cloud maintenance, test representative policy and session behavior, and retain update, configuration and traffic evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate failover and cloud maintenance. The vendor rates Cloud NGFW severity Low and Prisma Access Medium; do not extend the firewall base score or unauthenticated scenario to every product.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | All* | None* |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.4-h14; < 12.1.7-h12; < 12.1.10-h4 | >= 12.1.4-h14; >= 12.1.7-h12; >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.4-h24; < 11.2.7-h24; < 11.2.10-h18; < 11.2.13-h5; < 11.2.16-h2 | >= 11.2.4-h24; >= 11.2.7-h24; >= 11.2.10-h18; >= 11.2.13-h5; >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.4-h39; < 11.1.6-h41; < 11.1.7-h13; < 11.1.10-h37; < 11.1.13-h17; < 11.1.16-h5 | >= 11.1.4-h39; >= 11.1.6-h41; >= 11.1.7-h13; >= 11.1.10-h37; >= 11.1.13-h17; >= 11.1.16-h5 |
| PAN-OS 10.2 | < 10.2.7-h40; < 10.2.10-h43; < 10.2.13-h28; < 10.2.16-h13; < 10.2.18-h14 | >= 10.2.7-h40; >= 10.2.10-h43; >= 10.2.13-h28; >= 10.2.16-h13; >= 10.2.18-h14 |
| Prisma Access 12.1 | < 12.1.10-h4* | >= 12.1.10-h4* |
| Prisma Access 11.2 | < 11.2.7-h24* | >= 11.2.7-h24* |
| Prisma Access 10.2 | < 10.2.10-h43* | >= 10.2.10-h43* |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
