CVE-2026-0280: PAN-OS IPv6 Firewall Policy Bypass – Patch Now

Technical summary

CVE-2026-0280 is a dataplane vulnerability in PAN-OS affecting IPv6 packet processing logic. The flaw stems from improper bounds checking (CWE-131) in the firewall's traffic classification engine. Specifically, the vulnerability allows IPv6 packets to traverse security policy enforcement without proper validation, resulting in policy bypass. The attack vector is network-based with no authentication or privileges required. The scope is changed, meaning an attacker can impact resources and network segments beyond the direct application. Confidentiality and integrity are compromised; availability is not affected.

Business impact

Organizations relying on PAN-OS firewalls as a perimeter defense control face direct exposure. An attacker can exfiltrate data from or inject traffic into protected network segments by bypassing firewall rules. This undermines the core function of the firewall—enforcement of security policy—and may violate compliance controls that depend on firewall segmentation (PCI DSS, HIPAA, SOX). Incident response teams should assume that if IPv6 is enabled on affected firewalls, policy enforcement cannot be trusted without verification.

Affected systems

Palo Alto Networks PAN-OS in on-premises deployments is vulnerable across multiple versions. The source data indicates broad version coverage but does not enumerate specific version ranges; organizations must consult the official Palo Alto Networks security advisory to identify their patch status. Cloud NGFW and Panorama management appliances are explicitly not affected.

Exploitability

This vulnerability is highly exploitable. Attack complexity is low—no special conditions or timing are required. The attacker needs only network-level access to send IPv6 traffic, which is available on any IPv6-enabled segment. No authentication, special privileges, or user interaction are prerequisites. However, the vulnerability is not yet tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been formally catalogued as of the source data date.

Remediation

Apply the security patch released by Palo Alto Networks for your PAN-OS version. Verify the patch version against the official advisory. Until patching is complete, disable IPv6 on affected firewalls if operationally feasible, or restrict IPv6 traffic to trusted sources only. Panorama and Cloud NGFW users do not require action for this specific CVE.

Patch guidance

Contact Palo Alto Networks or consult the official security advisory published on 2026-07-09 (last modified 2026-08-11) to identify the fixed PAN-OS build for your deployment. Download and apply patches in a controlled manner, testing in a non-production environment first. Coordinate patching with your change management process, as firewall updates may require downtime or failover. Verify after patching that IPv6 traffic is correctly subject to security policies.

Detection guidance

Monitor firewall logs for IPv6 traffic that matches deny rules but appears to have bypassed policy enforcement. Enable detailed session logging on IPv6 traffic. Conduct a policy audit to confirm that IPv6 rules match your IPv6 security intent. Consider implementing network segmentation and monitoring to detect unexpected IPv6 traffic flows that bypass policy. SIEM integration with firewall logs can help identify anomalous traffic patterns post-patch validation.

Why prioritize this

This vulnerability scores 7.2 (HIGH) because it directly compromises the firewall's core mission: enforcing security policy. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) reflects that the attack is trivial to execute from the network, impacts confidentiality and integrity, and can affect other systems in scope. Organizations should treat this as critical to patch because firewall bypass is a foundational security control failure. The lack of KEV cataloging does not reduce urgency—it may reflect limited public awareness, not absence of risk.

Risk score, explained

A CVSS 3.1 score of 7.2 (HIGH) is justified because: (1) Network Attack Vector—any IPv6-capable network can reach the firewall; (2) Low Attack Complexity—no special conditions required; (3) No authentication or privileges—completely unauthenticated; (4) Changed scope—impacts not just the firewall but traffic intended for protected systems; (5) Partial Confidentiality and Integrity impact—allowed traffic can leak or inject data. The score does not assume availability impact, which aligns with the vulnerability only affecting policy bypass, not denial of service.

Frequently asked questions