Loading vulnerability…
PAN-OS XML Processing Buffer Overflow
CVE-2026-0310 is an out-of-bounds write vulnerability in the XML-processing functionality of Palo Alto Networks PAN-OS. Specially crafted XML received through a vulnerable management web or dataplane interface can trigger a buffer overflow. An unauthenticated network attacker can cause denial of service on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series hardware firewalls. Affected product lines include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before their applicable fixed builds. Panorama is also affected. Prisma Access and Cloud NGFW are affected under more restricted conditions requiring authentication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation on PA-Series hardware firewalls can compromise system confidentiality, integrity, and availability through root-level arbitrary code execution. Such compromise could enable unauthorized security-policy changes, configuration theft, traffic inspection or redirection, persistence, and access to connected internal systems. On VM-Series firewalls, the documented impact is denial of service, potentially disrupting firewall availability and traffic inspection; arbitrary code execution is not established for that platform. Panorama is affected, but its platform-specific exploitation outcome is not clearly established. Prisma Access and Cloud NGFW have lower practical exposure because authentication is required and external access is restricted.
If you can’t patch tonight, do this now.
No complete vendor workaround is available. Restrict management-interface access to trusted internal addresses, preferably allowing access only through a dedicated administrative jump box, and prevent exposure to untrusted networks. Restrict untrusted access to affected XML-processing services wherever feasible. Management-interface restrictions reduce risk but do not eliminate exposure through vulnerable dataplane interfaces. Monitor for unexpected crashes or restarts, anomalous administrative changes, and unusual management or dataplane traffic while awaiting patching.
Patch, then assume compromise.
Upgrade to an applicable fixed PAN-OS maintenance release or a later vendor-supported fixed release. Fixed builds are: 12.2: 12.2.3; 12.1: 12.1.4-h10, 12.1.7-h5, or 12.1.10; 11.2: 11.2.4-h21, 11.2.7-h20, 11.2.10-h14, or 11.2.13-h2; 11.1: 11.1.4-h36, 11.1.6-h38, 11.1.7-h10, 11.1.10-h33, 11.1.13-h12, or 11.1.16-h2; 10.2: 10.2.7-h37, 10.2.10-h40, 10.2.13-h24, 10.2.16-h10, or 10.2.18-h10. Select the build appropriate to the deployed maintenance branch and apply the corresponding Panorama security update. Migrate unsupported releases to a supported fixed version. Prisma Access fixes include 12.1.7-h5, 11.2.7-h20, or 10.2.10-h40, depending on the branch. Prisma Access and Cloud NGFW upgrades are scheduled through vendor maintenance; arrange an on-demand upgrade with Palo Alto Networks Support or the account team if earlier remediation is required. Prioritize PA-Series appliances because of the root-level code-execution impact.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.