CVE-2026-0258: PAN-OS: SSRF in IKEv2 Certificate URL Fetching
CVE-2026-0258 is a server-side request forgery (CWE-918) in the IKEv2 implementation of Palo Alto Networks PAN-OS. According to the record, an unauthenticated attacker may cause the firewall to send requests to unintended destinations or cause a denial of service. The record does not list fixed versions, so the vendor advisory should be consulted for remediation.
Overview
Palo Alto Networks reports a server-side request forgery vulnerability (CWE-918) in the IKEv2 implementation of PAN-OS. The record associates the issue with IKEv2 certificate URL fetching. Technical details beyond the record are in the vendor advisory.
Impact
- An unauthenticated attacker may cause the firewall to send network requests to unintended destinations.
- The same vulnerability may cause a denial of service condition.
- The record states that Panorama, Cloud NGFW and Prisma Access are not impacted.
Affected products and versions
- Palo Alto Networks PAN-OS: the record lists a large number of release branches and maintenance builds across several trains. This portal does not restate individual versions; check the full list in the vendor advisory.
- Siemens Ruggedcom APE1808 Firmware is listed in the record, with versions not specified by the source. See the Siemens advisory.
Exploitation status
- The record shows that this CVE is not listed in the CISA KEV catalog.
- No confirmed exploitation appears in the sources consulted.
- The record gives an SSVC exploitation value of none and an automatable value of no. The EPSS probability is 0.00328.
Remediation and mitigation
- Review the vendor advisory and apply the fixed PAN-OS builds for your release branch. The record does not list fixed versions, so do not assume a build is safe without checking the advisory.
- For Siemens Ruggedcom products, follow the guidance in the Siemens advisory.
- Limit exposure of IKE services to trusted peers where feasible, and restrict management and outbound paths.
- Test changes in a non-production environment before deploying them.
Detection guidance
- Review firewall logs for outbound connections initiated by the device that do not match expected business or management traffic.
- Watch for unusual IKE negotiation failures or unexplained resource exhaustion on the firewall.
- Correlate firewall-originated egress traffic with IKE activity to identify unexpected destinations.
Limitations of the available information
- The record does not provide fixed version strings, exact trigger conditions or proof-of-concept details, and this analysis does not add them.
- Specific versions affected in the Siemens product are not specified.
- Whether a particular IKEv2 configuration is required to trigger the issue is unknown from the record.
- The EPSS date in the record (2026-10-23) is later than the publication date; verify it against the source.
Frequently asked questions
What is CVE-2026-0258?
It is a server-side request forgery vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS, according to the record. It can let an unauthenticated attacker make the firewall send requests to unintended destinations or cause denial of service.
Is CVE-2026-0258 known to be exploited?
The record shows the CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which products are affected?
The record lists PAN-OS across many release branches and a Siemens Ruggedcom APE1808 firmware entry with unspecified versions. The record states Panorama, Cloud NGFW and Prisma Access are not impacted.
What should administrators do now?
Check the vendor advisory for fixed builds for your release branch, follow the Siemens advisory if you use that product, and reduce exposure of IKE services while you plan updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.