Palo Alto PAN-OS IPv6 Firewall Policy Bypass Vulnerability (CVE-2026-0280) and Patch

CVE-2026-0280 PAN-OS: IPv6 Firewall Policy Bypass Vulnerability Overview Vulnerability ID: CVE-2026-0280 Description: A vulnerability in the IPv6 packet processing of the data plane in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to bypass firewall security policies, enabling network traffic that should be blocked to reach protected services. Severity: LOW Urgency: MODERATE CVSS Score: 6.3 Attack Vector: NETWORK Attack Complexity: LOW User Interaction: NONE Privileges Required: NONE Product Confidentiality Impact: NONE Product Integrity Impact: NONE Product Availability Impact: NONE Post-Exploitation Confidentiality: LOW Post-Exploitation Integrity: LOW Post-Exploitation Availability: NONE Attack Requirements: PRESENT Automation: YES Scope of Impact: DIFFUSE Publication Date: 2026-07-09 Last Updated: 2026-07-09 Discoverer: externally Affected Versions Affected Versions: - PAN-OS 12.1: = 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 - PAN-OS 11.2: >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 - PAN-OS 11.1: >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 - PAN-OS 10.2: >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 - Panorama: All - Prisma Access 11.2.0: >= 11.2.7-h18 - Prisma Access 10.2.0: >= 10.2.10-h39 Remediation PAN-OS 12.1: Upgrade to version 12.1.7-h2 or later, or 12.1.8 or later. PAN-OS 11.2: Upgrade to version 11.2.13 or later. PAN-OS 11.1: Upgrade to version 11.1.16 or later. PAN-OS 10.2: Upgrade to version 10.2.18-h8 or later. Prisma Access 11.2.0: Upgrade to version 11.2.7-h18 or later. Prisma Access 10.2.0: Upgrade to version 10.2.10-h39 or later. Mitigations Disable the default "Non-SYN TCP Reject" setting using the following command: Acknowledgments Palo Alto Networks thanks Curious of TRAPA Security for discovering and reporting this issue. CPEs cpe:2.3:o:palo_alto_networks:pan-os:12.1.7- cpe:2.3:o:palo_alto_networks:pan-os:12.1.6- cpe:2.3:o:palo_alto_networks:pan-os:12.1.5- cpe:2.3:o:palo_alto_networks:pan-os:12.1.4- cpe:2.3:o:palo_alto_networks:pan-os:12.1.4-h5- cpe:2.3:o:palo_alto_networks:pan-os:12.1.4-h2- cpe:2.3:o:palo_alto_networks:pan-os:12.1.4- cpe:2.3:o:palo_alto_networks:pan-os:12.1.3- cpe:2.3:o:palo_alto_networks:pan-os:12.1.2- CPE Applicability cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.0 up to (excluding) 12.1.8 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.7 up to (excluding) 12.1.7-h2 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.4 up to (excluding) 12.1.4-h8 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.0 up to (excluding) 11.2.13 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.10 up to (excluding) 11.2.10-h11 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.7 up to (excluding) 11.2.7-h18 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.4 up to (excluding) 11.2.4-h20 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.0 up to (excluding) 11.1.16 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.13 up to (excluding) 11.1.13-h9 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.10 up to (excluding) 11.1.10-h30 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.7 up to (excluding) 11.1.7-h8 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.6 up to (excluding) 11.1.6-h35 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.4 up to (excluding) 11.1.4-h35 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.18 up to (excluding) 10.2.18-h8 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.16 up to (excluding) 10.2.16-h9 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.13 up to (excluding) 10.2.13-h23 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.10 up to (excluding) 10.2.10-h39 OR cpe:2.3:o:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.7 up to (excluding) 10.2.7-h36 or cpe:2.3:o:palo_alto_networks:prisma_access: is vulnerable from (including) 11.2.0 up to (excluding) 11.2.7-h18 OR cpe:2.3:o:palo_alto_networks:prisma_access:* is vulnerable from (including) 10.2.10 up to (excluding) 10.2.10-h39 Timeline 2026-07-09: Initial Publication

Goal Reached Thanks to every supporter — we hit 100%!

Palo Alto PAN-OS IPv6 Firewall Policy Bypass Vulnerability (CVE-2026-0280) and Patch