Palo Alto PAN-OS Vulnerabilities Including ADNS DoS (CVE-2026-0229)

Palo Alto Networks published fixes for multiple PAN-OS vulnerabilities affecting supported releases (including PAN-OS 12.1, 11.2, 11.1, and 10.2) and related services such as Prisma Access and Prisma Browser. The Canadian Centre for Cyber Security amplified the vendor guidance, pointing organizations to apply updates and mitigations for PAN-OS and Prisma products, including CVE-2026-0228 and CVE-2026-0229, and a separate Chromium monthly update advisory referenced by Palo Alto.

CVE-2026-0229 is a network-reachable denial-of-service condition in PAN-OS’s Advanced DNS Security (ADNS) feature that can allow an unauthenticated attacker to trigger system reboots with a maliciously crafted packet; repeated triggering can push a firewall into maintenance mode, creating a high availability impact. Exposure requires ADNS to be enabled and a spyware profile action set to block, sinkhole, or alert (i.e., not allow); Palo Alto stated Cloud NGFW and Prisma Access are not impacted by this specific issue and reported no known exploitation. CVE-2026-0228 involves improper certificate validation that can allow Windows Terminal Server Agents to connect using expired certificates under certain configurations, with no workaround noted by the vendor; affected organizations are advised to upgrade to fixed PAN-OS versions per Palo Alto’s guidance.