CVE-2026-0301 is an information disclosure flaw in the URL Filtering feature of Palo Alto Networks PAN-OS. The record scores it 7.5 (High); the vendor rates it Low (1.7). It only applies when a customised response page is used. Upgrade to a fixed release, or limit the page to the predefined variables.
What's affected
The weakness is CWE-908 (use of uninitialized resource). Panorama is not impacted. Cloud NGFW and Prisma Access are covered in the vendor notes, and the vendor will upgrade them in a maintenance cycle.
The vendor states the required configuration: URL filtering enabled with a customized response page. A device that imports a custom URL Filtering HTML response page is affected.
Affected and fixed versions from the vendor page:
- PAN-OS 12.1 and 11.2: not affected.
- PAN-OS 11.1: versions before 11.1.16-h1. Fixed in 11.1.16-h1.
- PAN-OS 10.2: versions before 10.2.8. The solution table says to upgrade to 10.2.8, or to 11.1.16-h1 or later.
- Prisma Access 10.2: versions before 10.2.10. Fixed in 10.2.10. Prisma Access 12.1 and 11.2 need no action.
Severity differs by source. The record lists CVSS 3.1 7.5 (High) with an unauthenticated network vector. The vendor lists CVSS-BT 1.7 and CVSS-B 6.3 on CVSS 4.0, and calls it Low with Moderate urgency. For Prisma Access it describes the risk as lower because exploitation needs an authenticated user. The vendor says it is not aware of malicious exploitation.
How to check if you're exposed
The vendor gives a direct check. In the PAN-OS web interface go to Device, then Response Pages. If you have imported a custom URL Filtering HTML response page, your device matches the required configuration.
Then check the software version. From the command line, show system info reports the PAN-OS version, which you can compare against the fixed releases above.
show system info | match sw-version
If you manage many firewalls, use Panorama or your inventory tool to list which ones carry a custom URL Filtering page and which run PAN-OS 11.1 or 10.2.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- List firewalls on PAN-OS 11.1 or 10.2 that use a custom URL Filtering response page.
- Upgrade PAN-OS 11.1 to 11.1.16-h1 or later, and PAN-OS 10.2 to 10.2.8 or 11.1.16-h1 or later. Move any unsupported older version to a supported fixed release.
- As a mitigation, limit the response page variables to the ones in the predefined pages: user, url, category and pan_form. The vendor says those variables are not impacted.
- For Prisma Access, wait for the scheduled upgrade, or ask Palo Alto Networks support for an on-demand window if you need it sooner.
- Review which custom response pages you still need. Removing an unused custom page removes the exposure.
Why it matters
Use of an uninitialized resource means a program reads memory it never set, so it can hand back whatever was left there. On a firewall, leftovers could include data from other traffic. The vendor classifies the exposure as retrieving embedded sensitive data.
The wide gap between the record score and the vendor score comes mostly from the narrow condition. Few devices carry a custom response page with unusual variables. If yours do, treat the record score as the worst case. The CVE is not marked as known exploited in the record.
Quick check
Is Panorama affected by CVE-2026-0301?
No. Both the record and the vendor say Panorama is not impacted.
Can I avoid the issue without upgrading?
The vendor says you can mitigate it by limiting the response page variables to the predefined ones: user, url, category and pan_form.
Sources
Last reviewed: 18 October 2026.
