CVE-2026-0310

A problem in the firewall's handling of specially crafted requests can allow an outsider to make it stop working or, on some physical firewall models, take it over completely. It is like a malicious person sending a malformed instruction to a building's security desk that either shuts the desk down or gives that person the master keys.

This matters to you if you run PAN-OS, Prisma Access, or Cloud NGFW. It affects organizations whose firewall management web interface or dataplane interface can be reached by an attacker; no login or user action is required.

A public exploit is available, and an attacker who can reach an affected interface needs no login. Treat this as a red-priority issue: upgrade on an urgent schedule and restrict access while the upgrade is arranged.

Confirm exposure by inventorying PAN-OS, Prisma Access, and Cloud NGFW deployments, recording their installed versions, and identifying whether their management web or dataplane interfaces are reachable from untrusted networks. For PAN-OS, upgrade the applicable branch to 12.2.3, 12.1.4-h10, 11.2.4-h21, 11.1.4-h36, or 10.2.7-h37; for Prisma Access, target 12.1.0, 11.2.4-h21, or 10.2.7-h37. Coordinate Cloud NGFW upgrades with Palo Alto Networks support. No workaround is known; if patching is delayed, restrict management access to trusted internal IP addresses and reduce unnecessary access to vulnerable interfaces. Monitor firewall availability, administrative changes, and unexpected activity involving XML requests or the affected interfaces. This CVE is not listed in CISA KEV, so no KEV due date applies.

CVE-2026-0310 is a CWE-787 buffer overflow in PAN-OS XML processing with network attack vector, no authentication, and no user interaction. An attacker with access to the management web interface or dataplane interface can cause DoS on VM-Series firewalls or execute arbitrary commands with root privileges on PA-Series firewalls. A public exploit is available. EPSS is 0.3% (27th percentile) with a flat trend; it is not in CISA KEV. The provided news item reports exploitation of unrelated CVE-2026-76460, not CVE-2026-0310.