CVE-2026-0229
📛 CVE Title
PAN-OS: Denial of Service in Advanced DNS Security Feature
Description
A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- palo_alto
- CVSS severity
- MEDIUM
- CVSS score
- 6.6 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber- Effective score
- 6.6 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-754 - Reserved
- 2025-11-03
- Published
- 2026-02-11 17:56 UTC
- Last updated
- 2026-02-11 18:58 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0229.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-02-11 18:16:07 UTC
- NVD last modified
- 2026-04-15 00:35:42 UTC
- EPSS score
- 0.0003 (probability of exploitation in next 30 days)
- EPSS percentile
- 8.06% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD / KEV / EPSS data refreshed 2026-05-25 04:50 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-5938 - Assigner
- palo_alto
- Published
- Feb 11, 2026, 5:56:09 PM
- Updated
- Feb 11, 2026, 6:58:48 PM
- EUVD base score (CVSS 4.0)
-
6.6 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber - EUVD-reported EPSS
- 0.0300
- Vendors
- Palo Alto Networks
- Products
-
PAN-OS (12.1.0 <12.1.4)PAN-OS (11.2.0 <11.2.10)PAN-OS (12.1.0 <12.1.4)PAN-OS (11.2.0 <11.2.10)
- Aliases
-
GHSA-cpfh-q3v8-wj73
ENISA description: A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
EUVD references (1)
Affected products (3)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
All (unaffected)
|
— |
| Palo Alto Networks | PAN-OS |
12.1.0 (affected),
11.2.0 (affected),
11.1.0 (unaffected),
10.2.0 (unaffected)
|
— |
| Palo Alto Networks | Prisma Access |
All (unaffected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://security.paloaltonetworks.com/CVE-2026-0229 vendor-advisory
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/754.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2026-0229 rapid7:attackerkb.com
- https://security.paloaltonetworks.com/CVE-2026-0229 rapid7:security.paloaltonetworks.com
- https://www.cve.org/CVERecord?id=CVE-2026-0229 rapid7:www.cve.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://security.paloaltonetworks.com/CVE-2026-0229 psirt@paloaltonetworks.com
Remediations (10)
-
web:krebsonsecurity.com
Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.
2026-05-23 21:34 UTC -
web:nvd.nist.gov
This is a potential security issue, you are being redirected to https://nvd.nist.gov
2026-05-23 21:34 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 21:34 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.
2026-05-23 21:34 UTC -
web:www.dbtsupport.com
The May 2026 Microsoft Patch Tuesday release includes security updates across supported Microsoft products and should be reviewed directly in the Microsoft Security Update Guide for the final CVE list, affected products, severity ratings, exploitability assessments, and any revised guidance.
2026-05-23 21:34 UTC -
web:www.oracle.com
Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay. Affected Products and Patch Information The security vulnerability addressed by this Security Alert affects the products listed below.
2026-05-23 21:34 UTC -
web:www.securityweek.com
Oracle issues out-of-band updates to patch CVE - 2026 -21992, a critical vulnerability in Identity Manager and Web Services Manager.
2026-05-23 21:34 UTC -
web:www.tenable.com
Key takeaways: The first Critical Patch Update (CPU) for 2026 , contains fixes for 158 unique CVEs in 337 security updates. 27 issues (8% of all patches) were assigned a critical severity rating. CVE - 2026 -21945, a high severity Server-Side Request Forgery (SSRF) vulnerability in Oracle Java was discovered by Tenable Research.
2026-05-23 21:34 UTC -
web:www.windowslatest.com
Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.
2026-05-23 21:34 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-23 21:34 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-0229.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-11T18:30:06.401502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T18:58:48.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.4",
"status": "unaffected"
}
],
"lessThan": "12.1.4",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.10",
"status": "unaffected"
}
],
"lessThan": "11.2.10",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.11",
"status": "unaffected"
}
],
"lessThan": "11.1.11",
"status": "unaffected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.17",
"status": "unaffected"
}
],
"lessThan": "10.2.17",
"status": "unaffected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "11.2.7-h10",
"status": "unaffected"
},
{
"at": "10.2.10-h28",
"status": "unaffected"
}
],
"lessThan": "10.2.10-h28",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The firewall must have Advanced DNS Security (ADNS) enabled and a spyware profile with actions configured to block, sinkhole, or alert (i.e., any non-allow value)."
}
],
"value": "The firewall must have Advanced DNS Security (ADNS) enabled and a spyware profile with actions configured to block, sinkhole, or alert (i.e., any non-allow value)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4",
"versionStartIncluding": "12.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.10",
"versionStartIncluding": "11.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "an internal reporter, jliu@TikkalaSecurity,"
}
],
"datePublic": "2026-02-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.<br><br>Cloud NGFW and Prisma Access\u00ae are not impacted by this vulnerability."
}
],
"value": "A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.\n\nCloud NGFW and Prisma Access\u00ae are not impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T17:56:09.270Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0229"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<table><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>Cloud NGFW All</td><td> </td><td>No action needed. </td></tr><tr>\n <td>PAN-OS 12.1<br></td>\n <td>12.1.2 through 12.1.3</td>\n <td>Upgrade to 12.1.4 or later.</td>\n </tr><tr>\n <td>PAN-OS 11.2<br></td>\n <td>11.2.0 through 11.2.9</td>\n <td>Upgrade to 11.2.10 or later.</td>\n </tr><tr><td>PAN-OS 11.1<br></td><td></td><td>No action needed.</td></tr><tr><td>PAN-OS 10.2<br></td><td></td><td>No action needed.</td></tr><tr><td>All older<br>unsupported<br>PAN-OS versions</td><td> </td><td>Upgrade to a supported fixed version.</td></tr><tr><td>Prisma Access All</td><td></td><td>No action needed.</td></tr></tbody></table>"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW All \u00a0 No action needed.\u00a0\nPAN-OS 12.1 12.1.2 through 12.1.3 Upgrade to 12.1.4 or later.\nPAN-OS 11.2 11.2.0 through 11.2.9 Upgrade to 11.2.10 or later.\nPAN-OS 11.1 No action needed.\nPAN-OS 10.2 No action needed.\nAll older \u00a0 Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access All No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-02-11T17:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Denial of Service in Advanced DNS Security Feature",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue. Due to the nature of this vulnerability, a Threat Prevention Signature to detect this is also not possible. "
}
],
"value": "No known workarounds exist for this issue. Due to the nature of this vulnerability, a Threat Prevention Signature to detect this is also not possible."
}
],
"x_affectedList": [
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0229",
"datePublished": "2026-02-11T17:56:09.270Z",
"dateReserved": "2025-11-03T20:43:50.406Z",
"dateUpdated": "2026-02-11T18:58:48.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}