CVE-2026-0263Disclosure(paloaltonetworks / pan-os)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch paloaltonetworks pan-os systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.

4.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-787

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pan-os

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 8 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • General: 2 classified signals
  • Peaked 3d ago at 3 mentions (2026-05-14); latest day: 1
  • 8 total mentions across 5 days

Affected systems

Products
pan-os

11 versions affected across 1 product

Deep dive

Activity timeline8 mentions / 5d
01223Mentions · 2026-05-13: 1Mentions · 2026-05-14: 3Mentions · 2026-05-15: 2Mentions · 2026-06-16: 1Mentions · 2026-07-28: 1Active Exploitation · 2026-05-14: 1Patch / Workaround · 2026-05-14: 1Technical Details · 2026-05-13: 1Technical Details · 2026-05-14: 1Technical Details · 2026-05-15: 1Technical Details · 2026-07-28: 105-1305-1405-1506-1607-28
Signal classification4 categories
Disclosure
450.0%
General
225.0%
Active Exploitation
112.5%
Patch
112.5%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-05-131
Disclosure1
2026-05-143
Active Exploitation1Disclosure1Patch1
2026-05-152
Disclosure1General1
2026-06-161
General1
2026-07-281
Disclosure1
Full discourse8 posts
  • Gray Hats@the_yellow_fall
    Patch

    Palo Alto Networks patches CVE-2026-0263 and CVE-2026-0265. Fixes for IKEv2 RCE and CAS bypass are now available. Update your PAN-OS firewalls immediately! #PaloAltoNetworks #PANOS #CyberSecurity #InfoSec #RCE #Firewall #VulnerabilityAlert #CVE https://securityonline.info/palo-alto-pan-os-vulnerability-cve-2026-0263-ikev2-overflow/ https://t.co/DYQjh0aG9x

    Post summary

    Palo Alto Networks has released patches for CVE-2026-0263 and CVE-2026-0265, addressing IKEv2 remote code execution and CAS bypass vulnerabilities, and urges customers to update PAN‑OS firewalls immediately.

    2602922.0K
    12.5K followersView on X
  • Powerrush@Powerrush_
    General

    @IntCyberDigest AHHHH but palo alto: https://security.paloaltonetworks.com/CVE-2026-0263

    Post summary

    The tweet merely links to a Palo Alto security page about CVE-2026-0263, offering no additional context or detail.

    10040559
    3.0K followersView on X
  • キタきつね@foxbook
    Disclosure

    Palo Alto PAN-OSでIKEv2バッファオーバーフローとCASバイパスの重大な脆弱性が発生 Critical IKEv2 Buffer Overflow and CAS Bypass Hit Palo Alto PAN-OS #DailyCyberSecurity (May 14) https://securityonline.info/palo-alto-pan-os-vulnerability-cve-2026-0263-ikev2-overflow/

    Post summary

    The post announces a critical IKEv2 buffer overflow and CAS bypass vulnerability in Palo Alto PAN‑OS (CVE‑2026‑0263) but offers no PoC, exploit code, or patch details.

    02020259
    4.9K followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    We have just added an important vulnerability affecting Palo Alto Cloud NGFW and other products (CVE-2026-0263) https://vuldb.com/vuln/363660

    Post summary

    The post announces the addition of CVE-2026-0263, a vulnerability affecting Palo Alto Cloud NGFW and other products, to a vulnerability database.

    01030142
    2.3K followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    Our CTI team identified a lot of activities targeting Palo Alto Cloud NGFW and other products (CVE-2026-0263) https://vuldb.com/vuln/363660/cti

    Post summary

    The CTI team reports ongoing activity targeting Palo Alto Cloud NGFW related to CVE‑2026‑0263, indicating potential real‑world exploitation, but no PoC, patch, or detailed vulnerability information is provided.

    0101089
    2.2K followersView on X
  • BREACHSPIDER@breachspider
    Disclosure

    [CVE Analysis] CVE-2026-0263: Unauthenticated IKEv2 Buffer Overflow in PAN-OS Threatens OT Perimeter Firewalls https://breachspider.com/intel/2026-07-28-cve-2026-0263-unauthenticated-ikev2-buffer-overflow-in-pan-o #ICS #OTSecurity #SCADA #CriticalInfrastructure

    Post summary

    The post announces the discovery of CVE-2026-0263, describing it as an unauthenticated IKEv2 buffer overflow in PAN-OS, but does not provide any exploitation details or mitigation information.

    0000047
    2.3K followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos Palo Alto ❗ CVE-2026-0265 ❗ CVE-2026-0263 ❗ CVE-2026-0257 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-palo-alto-3/ https://t.co/pRL81cMl80

    Post summary

    The post simply lists three Palo Alto CVE identifiers and directs readers to a general information page, with no additional technical details, exploitation evidence, or mitigation guidance.

    00000141
    6.7K followersView on X
  • ThreatCluster@threatcluster
    Disclosure

    BREAKING: Palo Alto Networks warns PAN-OS flaws CVE-2026-0263 and CVE-2026-0264 allow unauthenticated RCE and DoS on PA-Series firewalls via DNS Proxy and IKEv2 PQC configs. https://threatcluster.io/cluster/critical-buffer-overflow-vulnerabilities-in-pan-os-affecting-9dc147cc

    Post summary

    The tweet announces PAN‑OS vulnerabilities CVE‑2026‑0263 and CVE‑2026‑0264, which enable unauthenticated remote code execution and denial‑of‑service on PA‑Series firewalls via DNS Proxy and IKEv2 PQC configurations.

    00000134
    245 followersView on X
CPE platform detail94 entries

94 of 94 entries

PartVendorProductVersionTarget SWTarget HW
OSpaloaltonetworkspan-os---
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.13--
OSpaloaltonetworkspan-os11.1.13--
OSpaloaltonetworkspan-os11.1.13--
OSpaloaltonetworkspan-os11.1.13--
OSpaloaltonetworkspan-os11.1.14--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.7--
OSpaloaltonetworkspan-os11.1.7--
OSpaloaltonetworkspan-os11.1.7--
OSpaloaltonetworkspan-os11.1.7--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.11--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os12.1.4--
OSpaloaltonetworkspan-os12.1.4--
OSpaloaltonetworkspan-os12.1.4--

Explore more