An active IKE Gateway uses certificate-based authentication with CRL or OCSP revocation checking enabled, or
A DNS Proxy object is configured and enabled on the firewall.
Navigate to Network > Network Profiles > IKE Gateways.
Click on your active IKE Gateway name to open the configuration.
Under the General tab:
Verify Authentication is set to Certificate.
Confirm that a Certificate Profile is assigned.
Navigate to Device > Certificate Management > Certificate Profile.
Click on the Certificate Profile identified in the previous step.
Under the profile settings, verify if:
Use CRL is enabled or
Use OCSP is enabled.
Navigate to Network > DNS Proxy.
Review all configured DNS Proxy objects.
Click to open each DNS Proxy object and verify whether the Enable checkbox is selected.
A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface.
Cloud NGFW and Panorama are not affected by this vulnerability.
"}],"value":"A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface.\n\n\n\nCloud NGFW and Panorama are not affected by this vulnerability."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":4.6,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787 Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T19:39:54.302Z","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","shortName":"palo_alto"},"references":[{"tags":["vendor-advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0329"}],"solutions":[{"lang":"eng","supportingMedia":[{"base64":false,"type":"text/html","value":"| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW | No action needed. | |
| PAN-OS 12.2 | \n 12.2.0 through 12.2.4-h* | \nUpgrade to 12.2.4-h2 or later. | \n
| PAN-OS 12.1 | \n12.1.8 through 12.1.10-h* | \nUpgrade to 12.1.10-h4 or later. | \n
| \n | 12.1.5 through 12.1.7-h* | \nUpgrade to 12.1.7-h12 or later. | \n
| 12.1.2 through 12.1.4-h* | Upgrade to 12.1.4-h14 or later. | |
| PAN-OS 11.2 | \n 11.2.15 through 11.2.16-h* | \nUpgrade to 11.2.16-h2 or later. | \n
| \n | 11.2.11 through 11.2.13-h* | \nUpgrade to 11.2.13-h5 or 11.2.16-h2 or later. | \n
| \n | 11.2.8 through 11.2.10-h* | \nUpgrade to 11.2.10-h18 or 11.2.16-h2 or later. | \n
| \n | 11.2.5 through 11.2.7-h* | \nUpgrade to 11.2.7-h24 or 11.2.16-h2 or later. | \n
| \n | 11.2.0 through 11.2.4-h* | \nUpgrade to 11.2.4-h24 or 11.2.16-h2 or later. | \n
| PAN-OS 11.1 | \n 11.1.14 through 11.1.16-h* | \nUpgrade to 11.1.16-h5 or later. | \n
| \n | 11.1.11 through 11.1.13-h* | \nUpgrade to 11.1.13-h17 or 11.1.16-h5 or later. | \n
| \n | 11.1.8 through 11.1.10-h* | \nUpgrade to 11.1.10-h37 or 11.1.16-h5 or later. | \n
| \n | 11.1.7 through 11.1.7-h* | \nUpgrade to 11.1.7-h13 or 11.1.16-h5 or later. | \n
| \n | 11.1.5 through 11.1.6-h* | \nUpgrade to 11.1.6-h41 or 11.1.16-h5 or later. | \n
| \n | 11.1.0 through 11.1.4-h* | \nUpgrade to 11.1.4-h39 or 11.1.16-h5 or later. | \n
| PAN-OS 10.2 | \n 10.2.17 through 10.2.18-h* | \nUpgrade to 10.2.18-h14 or later. | \n
| \n | 10.2.14 through 10.2.16-h* | \nUpgrade to 10.2.16-h13 or 10.2.18-h14 or later. | \n
| \n | 10.2.11 through 10.2.13-h* | \nUpgrade to 10.2.13-h28 or 10.2.18-h14 or later. | \n
| \n | 10.2.8 through 10.2.10-h* | \nUpgrade to 10.2.10-h43 or 10.2.18-h14 or later. | \n
| \n | 10.2.0 through 10.2.7-h* | \nUpgrade to 10.2.7-h40 or 10.2.18-h14 or later. | \n
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access 12.1 | \n 12.1.2 through 12.1.10-h* | \nUpgrade to 12.1.10-h4 or later. | \n
| Prisma Access 11.2 | \n 11.2.0 through 11.2.7-h* | \nUpgrade to 11.2.7-h24 or later. | \n
| Prisma Access 10.2 | \n 10.2.0 through 10.2.10-h* | \nUpgrade to 10.2.10-h43 or later. | \n
Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510051 and 510052 (from Applications and Threats content version 9171-10349 and later). For these Threat IDs to protect against attacks for this vulnerability:
Please note that this Threat ID requires SSL Decryption.
Customers can mitigate the risk of this issue by taking the following actions.
Disable CRL and OCSP Revocation Checking:
Click on the Certificate Profile assigned to the active IKE Gateway.
Uncheck Use CRL.
Uncheck Use OCSP.
Click OK and Commit the changes.
Disable configured DNS proxy objects:
Navigate to Network > DNS Proxy.
Click on each configured DNS Proxy object.
Uncheck the Enable checkbox.
Click OK and Commit the changes.