Palo Alto Networks issues advisory for PAN-OS denial of service flaw

Palo Alto Networks has released an advisory for CVE-2026-0317, a denial of service vulnerability in its PAN-OS software. The flaw allows an authenticated user with a read-only administrator role to disrupt service by sending a specially crafted API request.

What happened

Palo Alto Networks identified a denial of service vulnerability in PAN-OS that enables service disruption through API manipulation. The issue arises when an authenticated user with a read-only administrator role sends a specially crafted request to the management web interface. This action triggers a denial of service condition on the affected device. The vendor rates the security risk as low, noting that the impact is minimized if access to the management interface is restricted to trusted internal IP addresses. No special configuration is required for a system to be vulnerable to this issue. Palo Alto Networks stated it is not aware of any malicious exploitation of this flaw in the wild.

Why it matters

The vulnerability affects a wide range of PAN-OS versions, spanning from 11.1.0 up to 12.2.3. Specifically, PAN-OS 12.2.0 through 12.2.3, 12.1.10 and earlier in the 12.1 branch, 11.2.0 through 11.2.15, and 11.1.0 through 11.1.16 are impacted. Versions 12.2.4 and later, as well as 11.2.16 and 11.1.16-h3, are not vulnerable. This broad version range means many organizations running older supported releases may be exposed. However, Cloud NGFW, Panorama, and Prisma Access are explicitly stated as not affected by this vulnerability.

What to watch

• Verify if your PAN-OS version falls within the vulnerable ranges listed in the advisory.
• Confirm that management web interface access is restricted to trusted internal IP addresses.
• Monitor for any updates indicating active exploitation of CVE-2026-0317.
• Check that read-only administrator accounts are limited to necessary personnel only.

Who needs to act first

Teams should prioritize reviewing access controls for management interfaces on affected PAN-OS devices. Since the flaw requires authentication, ensuring that only trusted internal addresses can reach the web interface significantly reduces risk. Organizations should audit read-only administrator accounts to ensure they are necessary and monitored. If updating is not immediately possible, restricting network access to the management plane is the primary mitigation. Test any configuration changes in a non-production environment first to avoid unintended service disruptions.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe

• Restrict access to the management web interface to trusted internal IP addresses only.
• Audit and limit the number of accounts with read-only administrator privileges.
• Plan to upgrade PAN-OS to a non-vulnerable version when maintenance windows allow.
• Monitor system logs for unusual API requests from read-only accounts.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PAN-OS versions are affected by CVE-2026-0317?

Versions 12.2.0 through 12.2.3, 12.1.10 through 12.1.0, 11.2.0 through 11.2.15, and 11.1.0 through 11.1.16 are vulnerable.

Is there a patch available for this denial of service flaw?

The advisory lists specific non-vulnerable versions,