{"id":"CVE-2026-0264","title":"PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution","summary":"A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms exc…","severity":"high","cvss":7.2,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:Y/R:U/V:C/RE:H/U:Red","cvssSource":"cna","cwe":["CWE-122"],"vendor":"Palo Alto Networks","product":"Cloud NGFW","affected":["cloud_ngfw","PAN-OS >= 12.1.0 < 12.1.7, 12.1.4-h5","PAN-OS >= 11.2.0 < 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17","PAN-OS >= 11.1.0 < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33","PAN-OS >= 10.2.0 < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34","prisma_access"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-05-13T00:00:00+00:00"},"published":"2026-05-13","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:11:31.819Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-0264","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0264"}],"tags":["cve.org"],"epss":0.00474,"epssPercentile":0.39412,"ingestedAt":"2026-10-15T05:52:46.053Z","slug":"CVE-2026-0264","body":"## Overview\n\nA buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only).\n\n\n\n\nPanorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.\n\n## Affected\n\n- `cloud_ngfw`\n- `PAN-OS >= 12.1.0 < 12.1.7, 12.1.4-h5`\n- `PAN-OS >= 11.2.0 < 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17`\n- `PAN-OS >= 11.1.0 < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33`\n- `PAN-OS >= 10.2.0 < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34`\n- `prisma_access`\n\n## Remediation\n\nVERSION                                 MINOR VERSION                SUGGESTED SOLUTION\nCloud NGFW                                                           No action needed\nPAN-OS 12.1                             12.1.5 through 12.1.6        Upgrade to 12.1.7 or later.\n                                        12.1.2 through 12.1.4-h*     Upgrade to 12.1.4-h5 or 12.1.7 or later.\nPAN-OS 11.2                             11.2.11 or later             Upgrade to 11.2.12 or later.\n                                        11.2.8 through 11.2.10-h*    Upgrade to 11.2.10-h6 or 11.2.12 or later.\n                                        11.2.5 through 11.2.7-h*     Upgrade to 11.2.7-h13 or 11.2.10 or later.\n                                        11.2.0 through 11.2.4-h*     Upgrade to 11.2.4-h17 or 11.2.7 or later.\nPAN-OS 11.1                             11.1.14 or later             Upgrade to 11.1.15 or later.\n                                        11.1.11 through 11.1.13-h*   Upgrade to 11.1.13-h5 or 11.1.15 or later.\n                                        11.1.8 through 11.1.10-h*    Upgrade to 11.1.10-h25 or 11.1.15 or later.\n                                        11.1.7 through 11.1.7-h*     Upgrade to 11.1.7-h6 or 11.1.15 or later.\n                                        11.1.5 through 11.1.6-h*     Upgrade to 11.1.6-h32 or 11.1.15 or later.\n                                        11.1.0 through 11.1.4-h*     Upgrade to 11.1.4-h33 or 11.1.15 or later.\nPAN-OS 10.2                             10.2.17 through 10.2.18-h*   Upgrade to 10.2.18-h6 or later.\n                                        10.2.14 through 10.2.16-h*   Upgrade to 10.2.16-h7 or 10.2.18-h6 or later.\n                                        10.2.11 through 10.2.13-h*   Upgrade to 10.2.13-h21 or 10.2.18-h6 or later.\n                                        10.2.8 through 10.2.10-h*    Upgrade to 10.2.10-h36 or 10.2.18-h6 or later.\n                                        10.2.0 through 10.2.7-h*     Upgrade to 10.2.7-h34 or 10.2.18-h6 or later.\nPrisma Access                                                        No action needed. \nAll older unsupported PAN-OS versions                                Upgrade to a supported fixed version.\n\n### Workarounds\n\nCustomers can mitigate the risk of this issue by taking either of the following actions:\n\nAction 1: \n\n * Disassociate DNS Proxy from externally accessible interfaces in order to reduce your attack surface; AND\n * Configure DNS server with a RFC1918 or a public trusted IP address.\n   \n\nOR Action 2:\n\n * Disable the DNS Proxy feature (Network > DNS Proxy) if it is not being used; AND\n * Configure DNS server with a RFC1918 or a public trusted IP address.\n\nCustomers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510027 from Applications and Threats content version 9100-10044 and later.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}