CVE Intelligence
Analysis AI-assisted

CVE-2026-0264: PAN-OS DNS Proxy and DNS Server Heap-Based Buffer Overflow

A heap-based buffer overflow in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS can be triggered by unauthenticated network traffic. The vendor describes denial of service on most PAN-OS platforms and possible code execution on PA-Series hardware only. The NVD base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0264 is a heap-based buffer overflow (CWE-122) in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS. The record attributes it to the vendor as CNA and lists the NVD base score as 9.8 (critical).

Impact

  • The vendor states that an unauthenticated attacker with network access can cause a denial of service on all PAN-OS platforms except Cloud NGFW and Prisma Access.
  • The vendor states that code execution is potentially possible, but only on PA-Series hardware.
  • Panorama, Cloud NGFW and Prisma Access are stated to be not impacted.

Affected products and versions

  • The record lists a large set of PAN-OS release and hotfix ranges as affected. Because the version strings in the record are long and partly inconsistent in format, this portal does not reproduce them; consult the vendor advisory for the authoritative list.
  • A third-party advisory from Siemens references Ruggedcom APE1808 firmware, with affected versions not specified by the source.
  • The record contains no fixed versions. A missing fixed-version field does not mean no fix exists.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • SSVC exploitation is recorded as none and automatable as no.
  • No confirmed exploitation appears in the sources consulted. The EPSS probability is about 0.47 percent.

Remediation and mitigation

  • Review the vendor advisory at Palo Alto Networks PSIRT for fixed releases and hotfixes applicable to your platform.
  • Prioritize PA-Series appliances and any PAN-OS deployment where the DNS proxy or DNS Server features are enabled.
  • Restrict management and data-plane exposure of DNS services to trusted networks until patches are applied.
  • Review the Siemens advisory at Siemens ProductCERT if Ruggedcom APE1808 devices are in use.

Detection guidance

  • Monitor for unexpected restarts, crashes or loss of DNS service on PAN-OS devices, which may indicate denial-of-service attempts.
  • Review logs for unusual volumes or malformed DNS traffic directed at the firewall's DNS features.
  • Correlate availability events with network telemetry at a high level; no specific indicators of compromise are provided in the record.

Limitations of the available information

  • The record does not provide exploit details, public proof-of-concept status, or the exact affected and fixed version boundaries in a usable format.
  • The record's CVSS vector is shown for version 3.1 at 9.8, and a version 4.0 score of 7.2 and 6.6 are also listed by the vendor as provided by the CNA; the sources differ on scoring context.
  • Exploitability for code execution is described as potential and limited to PA-Series hardware; the record does not confirm that code execution has been demonstrated.

Frequently asked questions

Does CVE-2026-0264 allow remote code execution?

The vendor description says code execution is potentially possible, but only on PA-Series hardware. The record does not confirm that code execution has been demonstrated.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

Which platforms are not affected?

The vendor states that Panorama, Cloud NGFW and Prisma Access are not impacted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.