CVE-2026-0310
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.2
- CVSS vector
- CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
- CWE
- CWE-787
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Palo Alto Networks Prisma Access
Weakness type
Related vulnerabilities
- CVE-2026-45770 — Suricata lua: excessive flow variable registration can bypass sandbox
- CVE-2026-88053 — Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
- CVE-2026-88052 — Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization
- CVE-2026-88051 — Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
- CVE-2026-88050 — Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
- CVE-2026-88049 — Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch
- CVE-2026-88048 — Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch
- CVE-2026-56711 — VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation