CVE-2026-0310

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in PAN-OS XML Processing

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: Palo Alto Networks, Inc.

Description

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-0310

EUVD

EUVD-2026-75253

Affected Vendors & Products

Vendor	Product	Version / Range
palo_alto_networks	pan-os	10.2
palo_alto_networks	pan-os	11.1
palo_alto_networks	pan-os	11.2
palo_alto_networks	pan-os	12.1
palo_alto_networks	pan-os	12.2
palo_alto_networks	prisma_access	10.2
palo_alto_networks	prisma_access	11.2
palo_alto_networks	prisma_access	12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-0310 is a buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software. An unauthenticated attacker with network access to the management web or dataplane interface could exploit this flaw to cause a denial of service (DoS) on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls.

Detection Guidance

Detecting this vulnerability requires checking for affected PAN-OS versions and monitoring for unusual activity on management or dataplane interfaces. Review firewall logs for XML processing errors or crashes. Use commands like 'show system info' to verify PAN-OS version and 'show log system' to inspect for anomalies. Ensure management interfaces are restricted to trusted IPs as per best practices.

Impact Analysis

This vulnerability could allow an attacker to cause a DoS condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. The impact varies by firewall type, with PA-Series hardware being more severely affected. Prisma Access and Cloud NGFW have lower risk due to restricted access and authentication requirements.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized access to sensitive data or system disruption. A successful exploit may lead to data breaches or service unavailability, which are critical violations under these regulations. Restricting management interface access to trusted internal IPs helps mitigate exposure but does not fully eliminate risk.

Mitigation Strategies

Immediately upgrade to the latest patched PAN-OS version. Restrict management interface access to trusted internal IP addresses. Disable unnecessary XML processing features if possible. Monitor for signs of exploitation and apply network segmentation to limit exposure. Follow Palo Alto's recommended deployment guidelines for securing management access.

Hi! I’m here to help you understand CVE-2026-0310. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70