Loading vulnerability…
RCE in PAN-OS IKEv2 Processing
CVE-2026-0263 is a buffer overflow vulnerability in the IKEv2 processing component of Palo Alto Networks PAN-OS. The flaw can be reached by an unauthenticated network-based attacker and may result in arbitrary code execution with elevated privileges on the affected firewall, or a denial-of-service condition. Available reporting indicates the issue is triggered only when IKEv2 VPN tunnels are configured to use Post Quantum Cryptography ciphers that are not NIST-approved. Panorama, Cloud NGFW, and Prisma Access are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow remote unauthenticated execution of arbitrary code with elevated privileges on the firewall, giving an attacker the ability to compromise the device at a highly privileged level. Where code execution is not achieved, exploitation can still crash or destabilize the affected service and cause denial of service.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the IKEv2 attack surface by disabling affected IKEv2 VPN configurations where operationally feasible, especially configurations using the vulnerable PQC cipher conditions described for this issue. Restrict network reachability to VPN services to only trusted peers and minimize external exposure until patched. Prioritize internet-exposed firewalls and systems providing IKEv2 services.
Patch, then assume compromise.
Upgrade PAN-OS to a fixed release in the supported branches. Reported fixed versions include PAN-OS 12.1.4-h5 and later, 12.1.7 and later, 11.2.4-h17 and later, 11.2.7-h13 and later, 11.2.10-h6 and later, 11.2.12 and later, 11.1.4-h33 and later, 11.1.6-h32 and later, 11.1.7-h6 and later, 11.1.10-h25 and later, 11.1.13-h5 and later, 11.1.15 and later, 10.2.7-h34 and later, 10.2.10-h36 and later, 10.2.16-h7 and later, and 10.2.18-h6 and later. Organizations should validate branch-specific applicability and deploy the vendor-provided security updates on exposed firewalls.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.