CVE-2026-0263 is a critical (CVSS 9.8) buffer overflow in the IKEv2 processing of Palo Alto Networks PAN-OS. An unauthenticated network attacker could run code on the firewall or cause denial of service. Upgrade to a fixed release for your branch. PAN-OS 10.2 is not affected.
What's affected
From the vendor advisory, PAN-OS is affected before these releases:
- PAN-OS 12.1: 12.1.4-h5 or 12.1.7 and later
- PAN-OS 11.2: 11.2.4-h17, 11.2.7-h13, 11.2.10-h6 or 11.2.12 and later
- PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later
PAN-OS 10.2, Panorama, Cloud NGFW and Prisma Access are not affected. Exposure requires IKEv2 VPN tunnels configured with Post Quantum Cryptography ciphers that are not NIST approved. Older unsupported PAN-OS versions should upgrade to a supported fixed version.
How to check if you're exposed
On the firewall CLI:
show system info | match sw-version
Compare the result with the fixed releases above for your branch.
Then review your IKEv2 VPN crypto profiles. The advisory says only tunnels using PQC ciphers that are not NIST approved are exposed. Firewalls without such tunnels do not meet the stated exposure condition, but should still be upgraded.
What to do now
- Find every PAN-OS firewall and its software version.
- Upgrade 12.1, 11.2 and 11.1 branches to the fixed releases above.
- As a mitigation, configure IKEv2 tunnels only with NIST approved PQC ciphers, per the vendor.
- Check the advisory for the full list of fixed maintenance releases if you run a hotfix build.
- Review VPN logs for unexpected IKEv2 negotiation failures or crashes.
Plan the upgrade as you would any firewall change. Pick the fixed release that matches your current maintenance train, since the advisory lists a separate minimum for each one. Hotfix builds carry an h suffix, so a version such as 11.2.7-h13 is newer than 11.2.7 and counts as fixed once it reaches the listed number.
If the firewalls run as a high availability pair, upgrade the passive unit first, check that it takes traffic, then move to the active one. Keep a saved configuration backup before you start, and read the release notes for the target version for any behaviour changes.
After the upgrade, run the version command again and record the result against each device. If you changed IKEv2 tunnels to use NIST approved PQC ciphers as a stopgap, write down which tunnels were touched, so the change can be reviewed later with the peers on the other end.
Ask the people who run the VPN peers whether they use PQC ciphers at all. That tells you quickly whether the exposure condition ever applied to you, and it is a useful fact for the incident record either way.
Why it matters
The weakness is CWE-787 (out-of-bounds write). The IKEv2 code writes past the end of a buffer when it processes certain traffic. A firewall sits at the network edge and handles unauthenticated traffic by design, so memory bugs in its VPN code are among the most serious kinds.
The vendor rates it high with the highest suggested urgency, a threat adjusted score of 7.2 and a base score of 9.2 on CVSS 4.0. It says it is not aware of malicious exploitation. The record does not mark it as KEV. The narrow exposure condition is the reason the threat adjusted score is lower than the base score.
Edge devices are attractive because they sit where the internet meets the network and run code that parses untrusted data before any login. A memory safety bug in a VPN parser is therefore different from a bug behind a login page. Even a narrow exposure condition, such as one cipher family, can include real production tunnels.
It is worth separating three questions when you read an advisory like this. First, are you running an affected version. Second, is the vulnerable feature configured. Third, can an outsider reach it. Here the answers are your software version, whether IKEv2 tunnels use the named ciphers, and whether the IKE ports face untrusted networks. Only the first is a software fact. The other two are configuration facts, and your configuration is what decides how urgent the work is.
Finally, remember that a vendor's threat adjusted score is a snapshot. It reflects what is known about exploitation today. It can change, so keep watching the advisory page, and favour patching on the early side when the product is a firewall.
Try it yourself
Several fixed releases exist for each branch. Seeing which fix applies to which version is the first step of a safe upgrade.
Click through it at your own pace, or open it full screen.
Quick check
Is PAN-OS 10.2 affected?
No. The advisory says PAN-OS 10.2 needs no action for this CVE.
What exposure condition does the advisory name?
IKEv2 VPN tunnels configured with PQC ciphers that are not NIST approved.
Why does the vendor score differ from the NVD score?
They use different scoring systems. The vendor adds exploit maturity and exposure conditions, and says it is not aware of malicious exploitation.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
