IPv6 Packet Processing Bypass in Palo Alto PAN-OS

Executive Summary

CVE-2026-0280 is a vulnerability in Palo Alto Networks PAN-OS software related to IPv6 packet processing in the dataplane. It allows an unauthenticated attacker to bypass firewall security policies by exploiting a flaw in how IPv6 packets are handled. This means that network traffic that should normally be blocked by the firewall can instead reach protected services.

This vulnerability affects PAN-OS firewalls with IPv6 enabled on one or more interfaces but does not impact Cloud NGFW or Panorama products.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized network traffic to bypass firewall security policies and reach protected services. This could potentially expose sensitive systems or data to attackers who should not have access.

Since the attacker does not need to be authenticated, the risk is higher as it can be exploited remotely without credentials.

The vulnerability has a moderate severity score (CVSS 6.3) and Palo Alto Networks recommends upgrading to patched versions or enabling a temporary mitigation setting called "Non SYN TCP Reject" to reduce risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to bypass firewall security policy enforcement, potentially permitting unauthorized network traffic to reach protected services.

Such a bypass could lead to unauthorized access or data exposure, which may impact compliance with security requirements in common standards and regulations like GDPR and HIPAA that mandate protection of sensitive data and network security controls.

However, the provided information does not explicitly describe the direct impact on compliance frameworks or specific regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, administrators can enable the "Non SYN TCP Reject" setting as a temporary measure.

The recommended permanent fix is to upgrade to a patched version of PAN-OS or Prisma Access according to the specific upgrade paths provided for each affected release.

Useful 0 Not Useful 0