PAN-OS: IPv6 Firewall Policy Bypass
Summary
| CVE | CVE-2026-0280 |
|---|---|
| State | PUBLISHED |
| Assigner | palo_alto |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-09 19:16:59 UTC |
| Updated | 2026-07-09 20:16:25 UTC |
| Description | An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability. |
Risk And Classification
Primary CVSS: v4.0 1.7 LOW from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Amber
EPSS: 0.004750000 probability, percentile 0.377940000 (date 2026-07-12)
Problem Types: CWE-131 | CWE-131 CWE-131 Incorrect Calculation of Buffer Size
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 1.7 | LOW | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/C... |
| 4.0 | CNA | CVSS | 1.7 | LOW | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/A... |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Amber
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Palo Alto Networks | Cloud NGFW | unaffected All custom | Not specified |
| CNA | Palo Alto Networks | PAN-OS | affected 12.1.0 12.1.8 custom | Not specified |
| CNA | Palo Alto Networks | PAN-OS | affected 11.2.0 11.2.13 custom | Not specified |
| CNA | Palo Alto Networks | PAN-OS | affected 11.1.0 11.1.16 custom | Not specified |
| CNA | Palo Alto Networks | PAN-OS | affected 10.2.0 10.2.18-h8 custom | Not specified |
| CNA | Palo Alto Networks | Panorama | unaffected All custom | Not specified |
| CNA | Palo Alto Networks | Prisma Access | affected 11.2.0 11.2.7-h18 custom | Not specified |
| CNA | Palo Alto Networks | Prisma Access | affected 10.2.0 10.2.10-h39 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.paloaltonetworks.com/CVE-2026-0280 | [email protected] | security.paloaltonetworks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Curious of TRAPA Security (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-08T16:00:00.000Z | Initial Publication |
Solutions
CNA: Version Minor Version Suggested Solution Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN-OS 11.2 11.2.11 through 11.2.12 Upgrade to 11.2.13 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h11 or 11.2.13 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h18 or 11.2.13 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h20 or 11.2.13 or later. PAN-OS 11.1 11.1.14 through 11.1.15 Upgrade to 11.1.16 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h9 or 11.1.16 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h30 or 11.1.16 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h8 or 11.1.16 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h35 or 11.1.16 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h35 or 11.1.16 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h8 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h9 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h23 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h39 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h36 or later. All older unsupported PAN-OS versions Upgrade to a supported fixed version.Prisma Access 11.2 11.2.0 through 11.2.7Upgrade to 11.2.7-h18 or later.*Prisma Access 10.210.2.0 through 10.2.10Upgrade to 10.2.10-h39 or later.* * See the note under Product Status for information regarding Prisma Access upgrades.
Workarounds
CNA: The only way to completely address this vulnerability is to upgrade to a fixed version. However, if operationally feasible for your environment, risk can be mitigated by enabling the default "Non SYN TCP Reject" setting via the following command: set deviceconfig setting session tcp-reject-non-syn yes
Exploits
CNA: Palo Alto Networks is not aware of any malicious exploitation of this issue.