Does PAN-OS DoS flaw CVE-2026-0317 expose your management interfaces?

The short version

• An authenticated user with a read-only administrator role can cause a denial of service condition.
• The attack vector involves sending a specially crafted API request to the management interface.
• Palo Alto Networks rates the severity as low due to the authentication requirement.

The details

Palo Alto Networks issued an advisory for CVE-2026-0317, a denial of service vulnerability in PAN-OS software. The flaw enables an authenticated user with a read-only administrator role to cause a denial of service by sending a specially crafted API request. According to the vendor, no special configuration is required to be affected by this issue. The security risk is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses, as per recommended best practices. Palo Alto Networks is not aware of any malicious exploitation of this issue. The CVSS base score is 5.1, classified as low severity.

The context

The vulnerability affects specific ranges of PAN-OS versions. Affected versions include PAN-OS 12.2.0 through 12.2.3. It also impacts PAN-OS 12.1.10 and earlier minor versions in the 12.1 branch. The 11.2 branch from 11.2.0 through 11.2.15 is vulnerable. Additionally, PAN-OS 11.1.16 and earlier versions in the 11.1 branch are affected. Cloud NGFW, Panorama and Prisma Access are not affected by this vulnerability. The issue is categorised under CWE-754, improper check for unusual or exceptional conditions.

Next steps

Organisations using affected PAN-OS versions should verify their current software version against the advisory. Teams should ensure that management interfaces are not accessible from untrusted networks. Access controls should be reviewed to limit administrator roles. Users should monitor for unusual API activity from read-only accounts. Once the vendor provides an update, patching should be prioritised for exposed systems.

What defenders should look for

Teams usually monitor management plane logs for anomalous API request patterns. Check whether read-only accounts are generating high volumes of requests. Look for sudden drops in management interface availability or responsiveness. Investigate any service interruptions that correlate with administrative access events. Containment moves typically involve isolating the management interface from untrusted zones. Restrict access to known internal IP addresses immediately. Review audit trails for unusual command execution by low-privilege users.

What to do and how to stay safe

• Verify your PAN-OS version against the affected list in the advisory.
• Restrict management interface access to trusted internal IP addresses only.
• Monitor API logs for unusual activity from read-only administrator accounts.
• Prepare to apply vendor updates once they become available for your version.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PAN-OS versions are affected by CVE-2026-0317?

Versions 12.2.0-12.2.3, 12.1.10 and earlier in 12.1, 11.2.0-11.2.15, and 11.1.16 and earlier in 11.1 are affected.

Is there active exploitation of this vulnerability?

Palo Alto Networks is not aware of any malicious exploitation of this issue according to the advisory.