PAN-OS Patches Protocol and Service Processing Memory Corruption
Tech GuruQuick Answer
Check SCTP protection, DNS proxy and OSPFv3 configuration, then deploy the branch-specific PAN-OS fix. Validate routing, DNS, traffic inspection and failover, retaining configuration and runtime evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Inspect SCTP Security and active SCTP Protection profiles, enabled DNS Proxy objects and OSPFv3 on IPv6 interfaces, including ESP-NULL authentication settings. Install the supported fixed build. The vendor lists detaching SCTP Protection profiles, disabling DNS Proxy objects and using non-ESP-NULL cryptographic OSPFv3 authentication as configuration-specific mitigations. Coordinate Cloud NGFW maintenance with support. Confirm the running build, test DNS resolution and IPv6 routing adjacencies, exercise permitted SCTP traffic and review service crashes.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS firewalls and Cloud NGFW with affected protocol or service configuration |
|---|---|
| Advisory | CVE-2026-0326 |
| CVE | CVE-2026-0326 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | PAN-OS 12.2, 12.1, 11.2 and 11.1 before the corresponding fixed builds below. Exposure depends on the SCTP, enabled DNS proxy or OSPFv3/IPv6 conditions in the authority. Cloud NGFW is listed as affected pending maintenance; Panorama and Prisma Access are not affected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; Cloud NGFW remediation through vendor maintenance |
| CVSS base score | 6.3 (CVSS v4.0 base score) |
| CVSS severity | Medium |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
Unauthenticated network traffic can cause a service process crash or memory corruption in affected protocol and service processing.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Inspect SCTP Security and active SCTP Protection profiles, enabled DNS Proxy objects and OSPFv3 on IPv6 interfaces, including ESP-NULL authentication settings.
- Remediate. Install the supported fixed build. The vendor lists detaching SCTP Protection profiles, disabling DNS Proxy objects and using non-ESP-NULL cryptographic OSPFv3 authentication as configuration-specific mitigations. Coordinate Cloud NGFW maintenance with support.
- Validate. Confirm the running build, test DNS resolution and IPv6 routing adjacencies, exercise permitted SCTP traffic and review service crashes.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Changing inspection, DNS or routing authentication can disrupt service or reduce protection. Review dependencies and use approved maintenance and recovery procedures before applying a temporary mitigation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | All* | None* |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.10-h4 | >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.16-h2 | >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.16-h5 | >= 11.1.16-h5 |
| Prisma Access | None | All |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
