Loading vulnerability…
DoS in Palo Alto Networks PAN-OS Advanced DNS Security
CVE-2026-0229 is a denial-of-service vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS. An unauthenticated attacker can send a maliciously crafted packet to a vulnerable system and trigger a system reboot. Repeated exploitation attempts can drive the firewall into maintenance mode, resulting in sustained loss of availability. Cloud NGFW and Prisma Access are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote unauthenticated attacker to disrupt availability of the affected firewall by forcing system reboots. Repeated triggering can escalate the condition from intermittent service interruption to the firewall entering maintenance mode, causing prolonged denial of service and loss of normal firewall functionality.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the ADNS feature to untrusted traffic where operationally feasible, restrict paths by which malformed packets can reach affected devices, and monitor for unexpected reboots or transitions into maintenance mode. Prioritize patching internet-exposed and critical-path firewalls. No specific vendor workaround is available in the provided information.
Patch, then assume compromise.
Upgrade PAN-OS to a fixed release identified by Palo Alto Networks. Reported fixed version boundaries include PAN-OS 10.2.17, 11.1.11, 11.2.8 or later in the affected branch, 11.2.10 in another affected branch, and 12.1.4. Organizations should validate the exact applicable target release for their deployed branch and platform against the vendor advisory before upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.