CVE-2026-0317: PAN-OS: Denial of Service Vulnerability
CVE-2026-0317
Summary
A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Products covered
Cloud NGFW
PAN-OS
Prisma Access
PAN-OS 12.1
PAN-OS 11.2
PAN-OS 11.1
PAN-OS 10.2
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
Cloud NGFW | No action needed. | |
PAN-OS 12.1 | 12.1.5 through 12.1.7-h* | Upgrade to 12.1.7-h2 or 12.1.8 or later. |
12.1.2 through 12.1.4-h* | Upgrade to 12.1.4-h8 or 12.1.8 or later. | |
PAN-OS 11.2 | 11.2.11 through 11.2.12 | Upgrade to 11.2.13 or later. |
11.2.8 through 11.2.10-h* | Upgrade to 11.2.10-h11 or 11.2.13 or later. | |
11.2.5 through 11.2.7-h* | Upgrade to 11.2.7-h18 or 11.2.13 or later. | |
11.2.0 through 11.2.4-h* | Upgrade to 11.2.4-h20 or 11.2.13 or later. | |
PAN-OS 11.1 | 11.1.14 through 11.1.15 | Upgrade to 11.1.16 or later. |
11.1.11 through 11.1.13-h* | Upgrade to 11.1.13-h9 or 11.1.16 or later. | |
11.1.8 through 11.1.10-h* | Upgrade to 11.1.10-h30 or 11.1.16 or later. | |
11.1.7 through 11.1.7-h* | Upgrade to 11.1.7-h8 or 11.1.16 or later. | |
11.1.5 through 11.1.6-h* | Upgrade to 11.1.6-h35 or 11.1.16 or later. | |
11.1.0 through 11.1.4-h* | Upgrade to 11.1.4-h35 or 11.1.16 or later. | |
PAN-OS 10.2 | 10.2.17 through 10.2.18-h* | Upgrade to 10.2.18-h8 or later. |
10.2.14 through 10.2.16-h* | Upgrade to 10.2.16-h9 or later. | |
10.2.11 through 10.2.13-h* | Upgrade to 10.2.13-h23 or later. | |
10.2.8 through 10.2.10-h* | Upgrade to 10.2.10-h39 or later. | |
10.2.0 through 10.2.7-h* | Upgrade to 10.2.7-h36 or later. | |
All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
Prisma Access | No action needed. |
Vendor-listed fixes
Cloud NGFW All
PAN-OS 12.1 >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8
PAN-OS 11.2 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13
PAN-OS 11.1 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16
PAN-OS 10.2 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8
Prisma Access All
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.