CVE-2026-0280CWE-131

CVE-2026-0280

High · published July 9, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services.

Cloud NGFW and Panorama are not impacted by this vulnerability.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-131 · Incorrect Calculation of Buffer Size
Published
2026-07-09T23:16Z
Affected products (203)
ProductVersionsFixed in
paloaltonetworks/pan-os≥ 10.2.0, < 10.2.710.2.7
paloaltonetworks/pan-os≥ 10.2.8, < 10.2.1010.2.10
paloaltonetworks/pan-os≥ 10.2.11, < 10.2.1310.2.13
paloaltonetworks/pan-os≥ 10.2.14, < 10.2.1610.2.16
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 11.1.0, < 11.1.411.1.4
paloaltonetworks/pan-os≥ 11.1.8, < 11.1.1011.1.10
paloaltonetworks/pan-os≥ 11.1.11, < 11.1.1311.1.13
paloaltonetworks/pan-os≥ 11.1.14, < 11.1.1611.1.16
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 11.2.0, < 11.2.411.2.4
paloaltonetworks/pan-os≥ 11.2.5, < 11.2.711.2.7
paloaltonetworks/pan-os≥ 11.2.8, < 11.2.1011.2.10
paloaltonetworks/pan-os≥ 11.2.11, < 11.2.1311.2.13
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-os≥ 12.1.2, < 12.1.412.1.4
paloaltonetworks/pan-os≥ 12.1.5, < 12.1.712.1.7
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
paloaltonetworks/pan-osall versions—
References (2)
EPSS history
Timeline
  • 09 JUL 19:05Z
    PAN-OS: IPv6 Firewall Policy Bypass
    cvelistv5