CVE Intelligence
Analysis AI-assisted

CVE-2026-0263: PAN-OS IKEv2 buffer overflow leading to remote code execution

CVE-2026-0263 is a buffer overflow in the IKEv2 processing of Palo Alto Networks PAN-OS. The vendor describes it as allowing an unauthenticated network attacker to execute code with elevated privileges on the firewall or to cause denial of service. NVD scores it 9.8 under CVSS 3.1, and the CNA scores it 7.2 under CVSS 4.0; the record shows no KEV listing and no fixed-version data, so remediation should follow the vendor advisory.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0263 affects the IKEv2 processing component of PAN-OS, the operating system of Palo Alto Networks firewalls. The weakness is recorded as CWE-787 (Out-of-bounds Write), and the vendor advisory describes a buffer overflow that can be triggered over the network without authentication. Panorama, Cloud NGFW and Prisma Access are stated by the vendor not to be impacted.

Impact

  • The vendor states that an unauthenticated network attacker could execute arbitrary code with elevated privileges on the firewall.
  • The vendor also states that the flaw can cause a denial-of-service condition.
  • NVD rates the issue 9.8 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CNA rates it 7.2 under CVSS 4.0.

Affected products and versions

  • Product: Palo Alto Networks PAN-OS.
  • The record lists many PAN-OS builds in the 11.1 and 11.2 release trains and a few 12.1 builds, using ranges such as from 11.1.0 before 11.1.15 and from 11.2.0 onward as recorded.
  • The record does not provide a clean list of fixed versions. Consult the vendor advisory for the authoritative affected and fixed builds.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The EPSS probability is 0.00373 (percentile 0.30036), and the SSVC fields show exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify all PAN-OS devices in your estate and compare their builds with the affected list in the vendor advisory.
  • Plan upgrades to a build that the vendor marks as not affected, since the record does not name a fixed version.
  • Until patched, limit exposure of IKE and IPsec services to trusted peers and reduce unnecessary reachability of VPN negotiation ports from untrusted networks.
  • Follow the vendor guidance for any interim mitigation it publishes.

Detection guidance

  • Review firewall management and system logs for crashes, restarts or unexpected process failures in the IKE component.
  • Monitor IKE negotiation traffic for malformed or unusual volume from untrusted sources.
  • Correlate unexpected configuration changes or new administrative sessions after anomalous VPN activity.

Limitations of the available information

The record does not include fixed versions, detailed technical conditions for exploitation beyond the vendor summary, or vendor-published workarounds. The CVSS 4.0 vector is not provided in the record, only the score. These gaps should be closed by consulting the vendor advisory.

Frequently asked questions

Does this CVE affect Panorama, Cloud NGFW or Prisma Access?

According to the description in the record, the vendor states that Panorama, Cloud NGFW and Prisma Access are not impacted by these vulnerabilities.

Is there a confirmed fixed version?

The record does not list fixed versions. Check the vendor advisory at security.paloaltonetworks.com for the authoritative fixed builds.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.