Cyber Resilience

CVE-2026-0269

Paloaltonetworks Pan-Os 10.2.0 – 10.2.7

Published
10 June 2026
Modified
14 July 2026
Patch / advisory
View advisory
CVSS Score v4 4.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
EPSS Score 0.0022 13th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-0269 is a medium-severity Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Paloaltonetworks Pan-Os. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter…

more

maintenance mode. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

CWE(s)
CWE-754

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1529 System Shutdown/Reboot Impact
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
attack.mitre.org →
Why these techniques?

Memory corruption in tunnel processing directly enables crafted-packet exploitation to force reboots (T1529) and application/system DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-0130Same product: Paloaltonetworks Pan-Os
CVE-2026-0227Same product: Paloaltonetworks Pan-Os
CVE-2024-9474Same product: Paloaltonetworks Pan-Os
CVE-2024-5913Same product: Paloaltonetworks Pan-Os
CVE-2025-0114Same product: Paloaltonetworks Pan-Os
CVE-2024-2551Same product: Paloaltonetworks Pan-Os
CVE-2023-6789Same product: Paloaltonetworks Pan-Os
CVE-2026-0281Same product: Paloaltonetworks Pan-Os
CVE-2024-0012Same product: Paloaltonetworks Pan-Os
CVE-2023-6795Same product: Paloaltonetworks Pan-Os

Affected Assets

paloaltonetworks
pan-os
10.2.10, 10.2.13, 10.2.16, 10.2.17, 10.2.7 · 10.2.0 — 10.2.7 · 10.2.8 — 10.2.10 · 10.2.11 — 10.2.13

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 7 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of tunnel traffic packets to block the malformed input that triggers memory corruption and forced reboots.

SI-16 Memory Protection good match
prevent

Applies memory protection mechanisms that can contain or prevent exploitation of the memory corruption flaw during tunnel processing.

SC-7 Boundary Protection partial match
prevent

Boundary protection at network ingress can filter or rate-limit maliciously crafted tunnel packets before they reach the vulnerable PAN-OS processing path.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly require proper checks and handling for exceptional conditions throughout the SDLC.

DE.CM-09 partial match
prevents

Runtime monitoring of software and environments can detect adverse events triggered by unhandled exceptional conditions.

PR.PS-04 partial match
prevents

Generating logs of exceptions and errors enables detection of improper handling of unusual conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development and acceptance verifies handling of error and exceptional conditions.

A.8.15 Logging partial match
detects

Logging can record unhandled exceptions but does not prevent the weakness itself.

A.8.16 Monitoring activities partial match
detects

Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for handling of exceptional conditions and error paths.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles require robust error and exception handling mechanisms.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (2 rules)
  • V-248573 The OL 8 file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency. via CWE-754
  • V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. via CWE-754
Oracle Linux 9 (1 rule)
  • V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. via CWE-754

References