CVE-2026-0310

PAN-OS: Buffer Overflow Vulnerability via XML Processing

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS —Not scored EPSS percentile28th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2026-09-10Updated 2026-09-11Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run PAN-OS, Prisma Access, or Cloud NGFW and record the installed software version.
Upgrade PAN-OS to 12.2.3, 12.1.4-h10, 11.2.4-h21, 11.1.4-h36, or 10.2.7-h37, as appropriate for your release branch.
Upgrade Prisma Access to 12.1.0, 11.2.4-h21, or 10.2.7-h37, as appropriate for your release branch.
Ask Palo Alto Networks support to schedule an on-demand Cloud NGFW software upgrade.
Until upgrades are complete, limit management-interface access to trusted internal IP addresses and restrict unnecessary network access to affected interfaces.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.

In plain language

Written by AI from the record

This flaw can let an outsider crash or take control of an unpatched PAN-OS, Prisma Access, or Cloud NGFW firewall, so affected small businesses should act urgently.

Unauthenticated network-reachable XML-processing buffer overflow (CWE-787) permits DoS on VM-Series systems or root-level arbitrary command execution on PA-Series firewalls.

If you're affected

Full firewall takeover
Network outage
Traffic interception
Business-service disruption
Ransomware risk

What is it

A problem in the firewall's handling of specially crafted requests can allow an outsider to make it stop working or, on some physical firewall models, take it over completely. It is like a malicious person sending a malformed instruction to a building's security desk that either shuts the desk down or gives that person the master keys.

Who is affected

This matters to you if you run PAN-OS, Prisma Access, or Cloud NGFW. It affects organizations whose firewall management web interface or dataplane interface can be reached by an attacker; no login or user action is required.

How urgent is it

A public exploit is available, and an attacker who can reach an affected interface needs no login. Treat this as a red-priority issue: upgrade on an urgent schedule and restrict access while the upgrade is arranged.

What to do — in detail

Confirm exposure by inventorying PAN-OS, Prisma Access, and Cloud NGFW deployments, recording their installed versions, and identifying whether their management web or dataplane interfaces are reachable from untrusted networks. For PAN-OS, upgrade the applicable branch to 12.2.3, 12.1.4-h10, 11.2.4-h21, 11.1.4-h36, or 10.2.7-h37; for Prisma Access, target 12.1.0, 11.2.4-h21, or 10.2.7-h37. Coordinate Cloud NGFW upgrades with Palo Alto Networks support. No workaround is known; if patching is delayed, restrict management access to trusted internal IP addresses and reduce unnecessary access to vulnerable interfaces. Monitor firewall availability, administrative changes, and unexpected activity involving XML requests or the affected interfaces. This CVE is not listed in CISA KEV, so no KEV due date applies.

Technical context

CVE-2026-0310 is a CWE-787 buffer overflow in PAN-OS XML processing with network attack vector, no authentication, and no user interaction. An attacker with access to the management web interface or dataplane interface can cause DoS on VM-Series firewalls or execute arbitrary commands with root privileges on PA-Series firewalls. A public exploit is available. EPSS is 0.3% (27th percentile) with a flat trend; it is not in CISA KEV. The provided news item reports exploitation of unrelated CVE-2026-76460, not CVE-2026-0310.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS28th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 28th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 2 days, from the signal feeds we watch.

2026-09-12OpenVAS check added
2026-09-11Patch availableworkaround available, record updated
2026-09-10Patch availablepatch available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated