Loading vulnerability…
Heap-Based Buffer Overflow in PAN-OS DNS Proxy and DNS Server
CVE-2026-0264 is a heap-based buffer overflow in the DNS Proxy and DNS Server features of Palo Alto Networks PAN-OS. An unauthenticated attacker with network access can trigger the overflow using specially crafted DNS traffic. Successful exploitation can cause denial of service on affected PAN-OS platforms and potentially arbitrary code execution on PA-Series hardware. On VM-Series firewalls, the identified impact is limited to denial of service. Panorama, Cloud NGFW, and Prisma Access are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disrupt the availability of affected PAN-OS firewalls through denial of service. On PA-Series hardware, exploitation may additionally permit arbitrary code execution. Virtual NGFW deployments, including those on Siemens RUGGEDCOM APE1808 devices, are susceptible to denial of service rather than the potential code-execution impact identified for PA-Series hardware.
If you can’t patch tonight, do this now.
Disassociate DNS Proxy from externally accessible interfaces and disable DNS Proxy if it is not required. Configure the DNS server with an RFC1918 private address or a trusted public IP address. Restrict network access to the affected DNS functionality to trusted systems.
Patch, then assume compromise.
Install the applicable PAN-OS release containing the vendor's fix for CVE-2026-0264. For Palo Alto Networks Virtual NGFW on Siemens RUGGEDCOM APE1808, version 11.2.10-h6 is explicitly identified as fixing this vulnerability; use that release or a later applicable fixed release. Exact fixed-version mappings for other PAN-OS branches are not established by the vulnerability-specific information available here.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.