CVE-2026-0264 is a critical (CVSS 9.8) heap based buffer overflow in the DNS proxy and DNS server features of PAN-OS. An unauthenticated attacker with network access can cause denial of service, and on PA-Series hardware may run code. Upgrade to a fixed release or reduce DNS proxy exposure.
What's affected
From the vendor advisory, PAN-OS is affected before these releases:
- PAN-OS 12.1: 12.1.4-h5 or 12.1.7 and later
- PAN-OS 11.2: 11.2.4-h17, 11.2.7-h13, 11.2.10-h6 or 11.2.12 and later
- PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later
- PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later
Panorama, Cloud NGFW and Prisma Access are not affected. Exposure requires either DNS Proxy enabled with a network interface attached to it, or a DNS server configured on the firewall that is a compromised, untrusted public IP address. Risk is higher when the interface faces an untrusted network. Code execution is described only for PA-Series hardware, and VM-Series is limited to denial of service.
How to check if you're exposed
On the firewall CLI:
show system info | match sw-version
Compare the result with the fixed releases above for your branch.
Then check the configuration. In the web interface, open Network, then DNS Proxy, and see whether a proxy is enabled and has interfaces attached. Open Device, then Setup, then Services, and read which DNS servers the firewall uses.
What to do now
- Upgrade to the fixed release for your branch from the list above.
- As a stopgap, disassociate DNS Proxy from externally reachable interfaces and set the firewall DNS servers to an RFC1918 or a trusted public address. This is Action 1 in the vendor guidance.
- Or disable DNS Proxy if you do not use it, and set trusted DNS servers. This is Action 2.
- With a Threat Prevention subscription, enable Threat ID 510027 (content version 9100-10044 or later).
- Prioritise PA-Series hardware, where the advisory says the risk is highest.
Plan the upgrade as you would any firewall change. Pick the fixed release that matches your current maintenance train, since the advisory lists a separate minimum for each one. Hotfix builds carry an h suffix, so a version such as 11.2.7-h13 is newer than 11.2.7 and counts as fixed once it reaches the listed number.
If the firewalls run as a high availability pair, upgrade the passive unit first, check that it takes traffic, then move to the active one. Keep a saved configuration backup before you start, and read the release notes for the target version for any behaviour changes.
If you used the DNS Proxy stopgap, keep a note of which interfaces you removed it from. Some networks depend on a firewall DNS proxy for internal name resolution, so test name lookups from a client after any change. If a branch office relies on the proxy, move it to a local resolver before you turn the proxy off.
Also review the DNS servers set on the firewall itself. The advisory says a compromised public DNS server is a second route to this bug, so servers you do not control are worth replacing with ones you do.
Why it matters
The weakness is CWE-122 (heap based buffer overflow). The DNS handling code copies data into a heap buffer without enough length checks. A DNS proxy is built to accept traffic from many hosts, and the vendor notes that a compromised upstream DNS server is a second route to the bug.
The vendor gives two ratings. For PA-Series it is high, with a threat adjusted score of 7.2, and for VM-Series it is medium at 6.6. It says it is not aware of malicious exploitation. The record does not mark it as KEV.
The mix of outcomes in this advisory is a useful lesson in reading severity. The same bug gives denial of service on virtual firewalls and possible code execution on hardware platforms. The vendor publishes two scores for that reason. If you only read the highest CVSS number, you lose the detail that tells you which of your devices carry the most risk.
DNS proxies are also a good example of a feature that is easy to leave on. It was turned on once for a branch or a lab, never removed, and then forgotten. A configuration review that lists enabled services on every firewall often finds features nobody needs, and turning them off reduces the exposure to this and to future bugs in the same code.
Finally, the second condition in the advisory, a compromised public DNS server, shows that the attack path can run through a dependency you trust. Pointing the firewall at resolvers you control is a small change with a real effect.
Try it yourself
New firewall advisories arrive without warning. A watch on your product list turns them into an action rather than a surprise.
Click through it at your own pace, or open it full screen.
Quick check
Does every firewall risk code execution?
No. The advisory describes code execution only for PA-Series hardware. Other platforms face denial of service.
What is the quickest stopgap?
Remove DNS Proxy from externally reachable interfaces and use trusted DNS servers, or disable DNS Proxy, then upgrade.
Does the DNS server setting matter?
Yes. The advisory lists a compromised public untrusted DNS server on the firewall as a second exposure path.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Also referenced by the CVE record:
Last reviewed: 19 October 2026.
