CVE-2026-0263

PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing

Severity: Critical9.8CVSS 3.1, Critical
EPSS: 0.37%
Published: 13 May 2026
Updated: 14 Jul 2026

Description

Title, description and vendor guidance are quoted from the source records.

A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.

Weakness: CWE-787

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.37% probability of exploitation in the next 30 days (percentile 29%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

Branch	Affected	Fixed in
12.1	>= 12.1.0, < 12.1.4-h5 >= 12.1.5, < 12.1.7	12.1.4-h5 12.1.7
11.2	>= 11.2.0, < 11.2.4-h17 >= 11.2.5, < 11.2.7-h13 >= 11.2.8, < 11.2.10-h6 >= 11.2.11, < 11.2.12	11.2.4-h17 11.2.7-h13 11.2.10-h6 11.2.12
11.1	>= 11.1.0, < 11.1.4-h33 >= 11.1.5, < 11.1.6-h32 >= 11.1.7, < 11.1.7-h6 >= 11.1.8, < 11.1.10-h25 >= 11.1.11, < 11.1.13-h5 >= 11.1.14, < 11.1.15	11.1.4-h33 11.1.6-h32 11.1.7-h6 11.1.10-h25 11.1.13-h5 11.1.15

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Workaround · PAN-OS

Customers using IKEv2 VPN can mitigate this issue by configuring IKEv2 VPN tunnels only with NIST approved Post Quantum Cryptography (PQC) ciphers.

Vendor remediation · PAN-OS

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.6 Upgrade to 12.1.7 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h5 or 12.1.7 or later. PAN-OS 11.2 11.2.11 or later Upgrade to 11.2.12 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h6 or 11.2.12 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h13 or 11.2.12 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h17 or 11.2.12 or later. PAN-OS 11.1 11.1.14 or later Upgrade to 11.1.15 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h5 or 11.1.15 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h25 or 11.1.15 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h6 or 11.1.15 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h32 or 11.1.15 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h33 or 11.1.15 or later. PAN-OS 10.2 No action needed. Prisma …

References

https://security.paloaltonetworks.com/CVE-2026-0263(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record): Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC