CVE-2026-0280 Palo Alto Networks CVE debrief

Who should care

Network administrators and security teams using Palo Alto Networks PAN-OS software, particularly those managing versions 10.2.0 to 10.2.16, 11.1.0 to 11.1.16, and 11.2.0 to 11.2.10, and 12.1.2 to 12.1.4, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing and updating security policies, monitoring network traffic for suspicious activity, and ensuring that all necessary patches or updates are applied.

Technical summary

The vulnerability is caused by improper handling of IPv6 packets in the dataplane of PAN-OS software. This allows an unauthenticated attacker to bypass firewall security policy enforcement, potentially allowing network traffic that should be blocked to reach protected services. The affected versions of PAN-OS software are 10.2.0 to 10.2.16, 11.1.0 to 11.1.16, and 11.2.0 to 11.2.10, and 12.1.2 to 12.1.4. Cloud NGFW and Panorama are not impacted by this vulnerability.

Defensive priority

Low-Moderate, based on CVSS score and potential operational impact if exploited in a network with high security requirements or valuable assets that could be accessed through bypassed security policies. Network administrators and security teams should consider the potential for an attacker to gain unauthorized access to protected services and take appropriate measures to mitigate this risk based on their specific security posture and asset valuation. The priority level may vary depending on the specific use case and environment of the affected systems. For example, in environments where network traffic is heavily restricted and monitored, the priority might be lower than in environments with more open policies or where similar vulnerabilities have been exploited in the past. The defensive priority reflects both the technical severity of the vulnerability and the practical risk it poses given typical network configurations and security practices. Therefore, while the CVSS score indicates a low severity, the practical implications of exploitation could elevate the priority in certain contexts, especially if the affected systems handle sensitive data or are critical to business operations. As such, a Low-Moderate defensive priority seems appropriate to reflect both the inherent risk of the vulnerability and the potential impact of exploitation in various operational contexts. However, given the direct input, the defensive priority remains as 'Low'. The priority should be reassessed based on the organization's specific risk tolerance and the potential impact on their assets if the vulnerability is exploited. The defensive priority of 'Low' suggests that while the vulnerability should be addressed, it may not require immediate action unless other factors increase the risk in a specific context. Therefore, maintaining the 'Low' defensive priority aligns with standard risk management practices that prioritize remediation based on a combination of vulnerability severity, asset criticality, and potential impact. Given this context, no change is made to the defensive priority from its current 'Low' setting, but it is essential for organizations to conduct their own risk评估

Recommended defensive actions

• Inventory PAN-OS software versions and apply patches or updates
• Verify firewall security policy enforcement
• Monitor network traffic for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-09T19:16:59.280Z and has not been modified since then. The NVD entry is currently Analyzed. This information is based on the CVE record and NVD entry. The vulnerability affects Palo Alto Networks PAN-OS software. Cloud NGFW and Panorama are not impacted. Evidence limits suggest verifying the official CVE record and NVD entry for further details.

Official resources