Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-0310

PAN-OS: Buffer Overflow Vulnerability via XML Processing

En bref

Sévérité
HIGH 7.2
EPSS
EPSS 0.67 % · centile 52 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
palo_alto
Statut NVD
Awaiting Analysis

Description

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.

Scores

VersionScoreVecteurÉvalué par
CVSS 4.0HIGH 7.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Redpalo_alto
CVSS 4.0MEDIUM 6.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amberpalo_alto
CVSS 4.0MEDIUM 4.8CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amberpalo_alto
CVSS 4.0MEDIUM 5.2CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amberpalo_alto
CVSS 4.0HIGH 7.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:RedNVD · psirt@paloaltonetworks.com (Secondary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Palo Alto Networks · Cloud NGFWaffected All
Palo Alto Networks · PAN-OSaffected 12.2.0 < 12.2.3 ; affected 12.1.0 < 12.1.4-h10 ; affected 11.2.0 < 11.2.4-h21 ; affected 11.1.0 < 11.1.4-h36 ; affected 10.2.0 < 10.2.7-h37
Palo Alto Networks · Prisma Accessunaffected 12.1.0 < 12.1.4-h10 ; affected 11.2.0 < 11.2.4-h21 ; affected 10.2.0 < 10.2.7-h37

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD