Description
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | — | All |
| Palo Alto Networks | PAN-OS | 12.1.0 – < 12.1.7, 12.1.4-h5, 11.2.0 – < 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17, 11.1.0 – < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33, 10.2.0 – < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 | 12.1.7, 12.1.4-h5 |
| Palo Alto Networks | Prisma Access | — | All |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
iam-s21-caece/PoC-CVE-2026-0264 ★ 0 · Nov 6, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- SSA-967325 SSA-967325: Multiple Vulnerabilities in Palo Alto Networks PAN-OS before V11.2.10-h7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Oct 13, 2026
- ICSA-26-139-02 Siemens RUGGEDCOM APE1808 Devices CISA ICS & IT advisories · Jul 2, 2026
- WID-SEC-2026-1528 Palo Alto Networks PAN-OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2026
References
- https://security.paloaltonetworks.com/CVE-2026-0264 vendor-advisory