CVE-2026-0321

Executive Summary

CVE-2026-0321 is a denial-of-service vulnerability in Palo Alto Networks PAN-OS software that allows an unauthenticated attacker with network access to crash or destabilize the firewall by sending specially crafted network traffic to or through a dataplane interface. Repeated triggering causes the device to enter maintenance mode, resulting in a sustained loss of availability. Cloud NGFW and Panorama are explicitly not affected; impacted deployments are limited to PAN-OS firewall instances with a reachable dataplane interface.

Technical Analysis

The vulnerability resides in the PAN-OS dataplane — the packet-processing layer responsible for forwarding, policy enforcement, and threat inspection on Palo Alto Networks next-generation firewalls. Per the NVD description, an attacker with network access who sends specially crafted network traffic directed "to or through a dataplane interface" can induce a denial-of-service condition. The flaw is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating that the dataplane fails to correctly handle a malformed, unexpected, or exceptional packet condition, leading to a fault rather than a controlled drop.

Key characteristics derivable from the advisory:

• Authentication: Not required. The attacker needs only network reachability to a dataplane interface.
• Attack vector: Network (adjacent or routed), directed at traffic transiting or terminating on the dataplane.
• Persistence of impact: A single event causes a DoS condition; repeated attempts escalate the device into maintenance mode, which is a degraded operational state requiring administrative intervention to recover.
• Scope exclusion: Cloud NGFW and Panorama are unaffected, confirming the issue is specific to the on-premises/virtual PAN-OS dataplane implementation rather than the management plane or centralized management components.

No specific packet structure, protocol field, parser function, or code path is disclosed in the provided data. The precise malformed condition (e.g., which protocol, which header field, or which traffic pattern) cannot be determined from available information and is not fabricated here. What is clear is the class: an exception-handling defect in the dataplane's traffic processing logic that is reachable pre-authentication via crafted packets.

Because the dataplane sits in the traffic path, a successful trigger disrupts not only the firewall's own availability but potentially all traffic flows the device is responsible for inspecting and forwarding. The maintenance-mode transition implies the dataplane reaches a state the operating system cannot auto-recover from, forcing a manual/administrative reset.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-0321. The following attack chain is inferred strictly from the vulnerability class (unauthenticated network DoS via crafted traffic to a dataplane interface) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies Palo Alto Networks PAN-OS firewall dataplane interfaces that are network-reachable. Because Cloud NGFW and Panorama are not affected, targets are on-premises or virtual PAN-OS firewall deployments. Reachability to the dataplane (rather than only the management plane) is the key targeting requirement. Shodan/Censys queries for PAN-OS product fingerprints and management interfaces can support identification, though the dataplane interface is the actual attack surface.

2. Triggering the flaw. The attacker sends specially crafted network traffic directed to or through a dataplane interface. The crafted traffic exercises an unusual or exceptional condition the dataplane does not handle safely (CWE-754), causing a DoS condition. No authentication is required — the flaw is reachable pre-auth, so no credentials or session are needed.

3. Payload / execution method. At the vulnerability-class level, the payload is crafted network traffic ("packets") — not a memory-corruption exploit, not a web request to an authenticated endpoint. The specific malformed packet contents are not disclosed in the advisory and cannot be responsibly reconstructed from the data provided. The attacker simply needs a network path and the ability to emit packets toward the dataplane.

4. Post-exploitation impact. A single trigger causes a denial-of-service condition affecting the firewall's traffic processing. Per the advisory, repeated trigger attempts drive the firewall into maintenance mode — a persistent degraded state requiring administrative recovery. The practical outcome is outage of firewall-protected connectivity and inspection, i.e., availability loss rather than confidentiality or integrity compromise.

Because no in-the-wild exploitation, threat actor association, or public exploit is recorded (EPSS 0.00326, 24.0th percentile; CISA KEV: NO), this scenario represents potential rather than observed activity. The unauthenticated, network-reachable nature combined with the maintenance-mode escalation makes it attractive to availability-focused adversaries (e.g., hacktivists, disruptive actors), but no attribution is supported by the data.

Impact Assessment

The primary impact is availability. The vulnerability enables an unauthenticated, network-reachable denial of service against a security control that sits inline in the network path. Consequences include:

• Loss of firewall availability: Crafted traffic causes a DoS condition; repeated attempts put the device into maintenance mode, requiring administrative intervention.
• Collateral connectivity outage: A PAN-OS firewall is typically inline; its degradation can disrupt inspected and forwarded traffic for all downstream segments it protects.
• Security-control gap: During the outage or maintenance-mode period, inspection and policy enforcement are effectively removed, creating a window of reduced visibility and enforcement.
• Recovery burden: Maintenance mode implies operational effort (and potentially a maintenance window) to restore service, extending impact duration.

Affected systems: On-premises and virtual PAN-OS firewall deployments with a network-reachable dataplane interface. Not affected: Cloud NGFW and Panorama (explicitly stated).

CVSS reference: No official CVSS score or vector was published in the provided data (CVSS Score: N/A). An inferred vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is consistent with an unauthenticated remote availability-only impact, but it is inferred, not authoritative, and should not be cited as the vendor score. EPSS is 0.00326 (24.0th percentile), indicating low current exploitation likelihood.

Blast radius: Organizations relying on affected PAN-OS firewalls for perimeter or internal segmentation face potential network-wide availability degradation, with the largest impact on environments where the firewall is a single inline chokepoint.

Detection Guidance

Sigma Rule

Detection of CVE-2026-0321 focuses on log signals of dataplane faults and transitions to maintenance mode. The rule below keys on PAN-OS system/severity events indicating dataplane failure or maintenance-mode entry, since no packet-level signature is publicly documented.

title: Potential PAN-OS Dataplane DoS - Maintenance Mode Transition (CVE-2026-0321)
id: 6f3c1a2e-9b7d-4c1a-8e2f-2d9c0321aa01
status: experimental
description: Detects PAN-OS events indicating a dataplane denial-of-service condition or entry into maintenance mode, consistent with CVE-2026-0321.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-0321
author: valtersit.com
date: 2026/01/01
logsource:
  product: paloalto
  service: panos
detection:
  selection_dp:
    message|contains:
      - 'dataplane'
      - 'data plane'
  selection_fault:
    message|contains:
      - 'maintenance mode'
      - 'entering maintenance'
      - 'dataplane process'
      - 'dataplane restart'
      - 'packet processing'
  condition: selection_dp and selection_fault
falsepositives:
  - Legitimate upgrades or maintenance operations
  - Unrelated dataplane software defects
level: high
tags:
  - attack.t1499
  - cve.2026.0321

YARA Rule

No malicious file artifact is associated with CVE-2026-0321 (it is a network-triggered DoS). This YARA rule is therefore oriented toward hunting captured packet payloads (PCAP files) that an analyst may collect during incident response, matching on generic PAN-OS fault indicators is not file-based. As such, the rule below targets response artifacts (logs/PCAP exports) named around the CVE and looks for maintenance-mode strings within them.

rule CVE_2026_0321_PANOS_Dataplane_DoS_Artifacts
{
    meta:
        description = "Hunts response artifacts (logs/PCAP exports) referencing PAN-OS dataplane failure or maintenance mode for CVE-2026-0321"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-0321"
        date = "2026-01-01"
        cve = "CVE-2026-0321"

    strings:
        $s1 = "maintenance mode" ascii nocase
        $s2 = "dataplane" ascii nocase
        $s3 = "data plane" ascii nocase
        $s4 = "CVE-2026-0321" ascii
        $s5 = "PAN-OS" ascii

    condition:
        filesize < 50MB and
        (
            (2 of ($s1, $s2, $s3)) or
            ($s4 and any of ($s5))
        )
}

Note: because the vulnerability is triggered by network traffic and leaves no distinctive file artifact, YARA is of limited detection value here; it is provided for triage of collected evidence bundles only.

Suricata IDS Rule

No packet signature is publicly documented for the crafted traffic. The rule below is a defensive heuristic that alerts on unusual volumes of traffic toward PAN-OS dataplane management/dataplane-associated services from a single untrusted source. It should be tuned; it cannot precisely match the undisclosed trigger condition.

alert tcp any any -> any any (msg:"CVE-2026-0321 Possible PAN-OS Dataplane DoS - high-rate single-source traffic"; flow:to_server; threshold:type both, track by_src, count 500, seconds 10; classtype:attempted-dos; reference:cve,2026-0321; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-0321; sid:2026032101; rev:1;)

Given the absence of a published packet structure, this rule detects anomalous high-rate single-source traffic patterns rather than the specific malformed packet. It is a compensating control, not a signature for the precise trigger.

Elastic Detection

Keys on PAN-OS logs showing dataplane fault or maintenance-mode transitions.

sequence by host.id with maxspan=5m
  [ any where event.category == "network" and
      process.name : "panos" and
      message : ("*dataplane*" or "*data plane*") ]
  [ any where event.category == "network" and
      message : ("*maintenance mode*" or "*entering maintenance*" or "*dataplane restart*") ]

If PAN-OS logs are ingested via a syslog pipeline into logs-paloalto.* indices, an EQL query over message fields for the same string set is recommended. Detection reliability depends on PAN-OS forwarding system logs (severity warning/critical) to the SIEM.

Splunk SPL Query

Search PAN-OS system logs for dataplane faults and maintenance-mode transitions, and correlate repeated events by device.

index=paloalto sourcetype=pan:system OR sourcetype=panos:system
| search ("dataplane" OR "data plane" OR "maintenance mode" OR "entering maintenance" OR "dataplane restart")
| stats count values(_raw) as events by host
| where count >= 2
| sort - count

For environments forwarding syslog, adjust index/sourcetype accordingly. Alert when a single host shows repeated dataplane/maintenance events in a short window, consistent with the advisory's note that repeated trigger attempts lead to maintenance mode.

Wazuh OSSEC Rule

Wazuh rule to alert on PAN-OS syslog messages indicating dataplane failure or maintenance mode.

<group name="paloalto,panos,cve-2026-0321">
  <rule id="20260321" level="12">
    <decoded_as>paloalto</decoded_as>
    <match>dataplane|data plane</match>
    <regex>"(maintenance mode|entering maintenance|dataplane restart|packet processing)"</regex>
    <description>CVE-2026-0321: PAN-OS dataplane DoS / maintenance-mode transition detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,paloalto,</group>
  </rule>
</group>

Adjust the <decoded_as> and <match> fields to match your PAN-OS syslog decoder and log format. Escalation to level 12 reflects high availability impact.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source. No vendor fix reference or affected version list was published in the provided data, and no workaround was supplied. The guidance below is therefore containment-oriented until an official PAN-OS fix is available.

1. Immediate mitigations (compensating controls):

   • Restrict network reachability to PAN-OS dataplane interfaces to only trusted, expected traffic paths; where feasible, implement upstream ACLs and segmentation to reduce the set of sources that can emit packets toward the dataplane.
   • Apply rate limiting / anomaly detection for high-rate single-source traffic patterns toward dataplane-adjacent interfaces (the Suricata rule above supports this).
   • Ensure PAN-OS system logs are forwarded to the SIEM and alerting is enabled on dataplane faults and maintenance-mode transitions, so repeated attempts are detected quickly.
   • Monitor for the escalation pattern (repeated triggers → maintenance mode) as an active attack indicator rather than a one-off fault.

2. Patch/upgrade steps:

   • No patch or fixed version is identified in the provided data. Monitor the Palo Alto Networks Security Advisories portal for the CVE-2026-0321 advisory and the corresponding fixed PAN-OS release.
   • Once a fixed release is published, plan an upgrade during a maintenance window; because repeated exploitation pushes devices into maintenance mode, prioritize internet-facing and inline critical-path firewalls.
   • Verify patch status by confirming the installed PAN-OS version against the vendor's affected/fixed version matrix when published.

3. Long-term hardening:

   • Minimize management-plane and dataplane exposure; enforce strict segmentation so unauthenticated network sources cannot reach dataplane interfaces unnecessarily.
   • Deploy out-of-band/redundant firewalls (HA pairs) so a single device entering maintenance mode does not cause a full connectivity outage.
   • Establish continuous monitoring and alerting for dataplane health, with automatic detection of maintenance-mode transitions.
   • Maintain an inventory of PAN-OS device versions to rapidly assess exposure when a fixed release and version matrix are published.
   • Track vendor advisories and EPSS/CISA KEV status for this CVE as intelligence develops.

References

• NVD — CVE-2026-0321: https://nvd.nist.gov/vuln/detail/CVE-2026-0321
• Palo Alto Networks Security Advisories portal: https://security.paloaltonetworks.com/
• CWE-754 — Improper Check for Unusual or Exceptional Conditions: https://cwe.mitre.org/data/definitions/754.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-0321 EPSS 0.00326, 24.0th percentile)

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV listing were identified for this CVE in the provided data. CISA KEV status: NO.