CVE-2026-0229: Palo Alto PAN-OS ADNS DoS Vulnerability

CVE-2026-0229 Overview

A denial-of-service (DoS) vulnerability exists in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software. This vulnerability enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet sent over the network. Repeated exploitation attempts can cause the firewall to enter maintenance mode, effectively taking the security appliance offline and disrupting network protection capabilities.

The vulnerability stems from improper handling of exceptional conditions (CWE-754) within the ADNS component, where specially crafted DNS packets trigger unexpected behavior leading to system instability.

Critical Impact

Unauthenticated attackers can remotely force firewall reboots and potentially push devices into maintenance mode, causing extended network security outages.

Affected Products

• Palo Alto Networks PAN-OS® software with Advanced DNS Security (ADNS) feature enabled
• On-premises Palo Alto Networks firewall appliances running vulnerable PAN-OS versions

Note: Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

Discovery Timeline

• 2026-02-11 - CVE-2026-0229 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-0229

Vulnerability Analysis

This denial-of-service vulnerability affects the Advanced DNS Security (ADNS) feature within PAN-OS software. The vulnerability allows remote, unauthenticated attackers to craft malicious packets that, when processed by the ADNS component, cause the firewall system to reboot unexpectedly.

The attack can be executed over the network without requiring any authentication or user interaction, making it particularly concerning for internet-facing firewall deployments. The primary impact is availability loss—while confidentiality and integrity remain unaffected, the disruption to firewall services can leave networks temporarily unprotected.

When an attacker repeatedly sends malicious packets to exploit this vulnerability, the continuous reboot cycles can eventually force the firewall into maintenance mode. This escalated condition requires manual administrator intervention to restore normal operations, significantly extending the impact window beyond individual reboot events.

Root Cause

The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions). The ADNS feature fails to properly validate and handle certain exceptional conditions when processing DNS security-related packets. This improper exception handling allows malformed or unexpected packet structures to trigger uncontrolled system behavior, ultimately resulting in a system reboot.

The root cause indicates that the DNS packet parsing or processing logic lacks adequate bounds checking or error handling for edge cases that deviate from expected input formats.

Attack Vector

The attack is network-based and can be executed remotely by an unauthenticated attacker. The attack flow involves:

1. Attacker identifies a target Palo Alto Networks firewall with ADNS feature enabled
2. Attacker crafts a malicious packet designed to exploit the improper exception handling
3. Malicious packet is sent to the target firewall over the network
4. ADNS component processes the packet and encounters an unhandled exceptional condition
5. Firewall system initiates an unexpected reboot
6. Repeated attacks can force the firewall into maintenance mode

The exploitation requires no special privileges, no user interaction, and can be performed remotely, making the attack relatively straightforward to execute once the vulnerability details are understood.

Detection Methods for CVE-2026-0229

Indicators of Compromise

• Unexpected or frequent firewall reboots without administrative action or scheduled maintenance
• Firewall entering maintenance mode without clear cause
• Anomalous DNS-related traffic patterns targeting the firewall management or data plane interfaces
• System logs showing repeated crash events associated with ADNS processing

Detection Strategies

• Monitor firewall system logs for unexpected reboot events and ADNS-related errors
• Implement network traffic analysis to detect unusual DNS packet patterns or volumes targeting firewall appliances
• Configure SIEM alerts for repeated firewall availability events within short time windows
• Review firewall health monitoring dashboards for availability anomalies

Monitoring Recommendations

• Enable comprehensive logging for ADNS feature events and system health metrics
• Deploy network-based intrusion detection to identify potential exploitation traffic patterns
• Establish baseline firewall reboot frequency and alert on deviations
• Monitor for maintenance mode entry events across all managed firewall appliances

How to Mitigate CVE-2026-0229

Immediate Actions Required

• Review Palo Alto Networks CVE-2026-0229 Advisory for the latest patch information and affected version details
• Identify all PAN-OS deployments with Advanced DNS Security (ADNS) feature enabled
• Prioritize patching for internet-facing firewall appliances
• Consider temporarily disabling the ADNS feature if patches cannot be immediately applied and the feature is not critical to operations

Patch Information

Palo Alto Networks has released information regarding this vulnerability. Administrators should consult the official Palo Alto Networks Security Advisory to determine which PAN-OS versions are affected and which patched versions are available.

Ensure your PAN-OS deployment is updated to a version that addresses this vulnerability. Follow standard change management procedures when applying patches to production firewall infrastructure.

Workarounds

• Temporarily disable the Advanced DNS Security (ADNS) feature if it is not essential for your security posture
• Implement network access controls to restrict which sources can send traffic to the firewall
• Deploy upstream filtering to limit exposure of firewall interfaces to untrusted networks
• Consider implementing rate limiting on DNS-related traffic to the firewall if operationally feasible

# Example: Check current PAN-OS version (run from firewall CLI)
show system info | match "sw-version"

# Review ADNS feature status
show dns-proxy dns-server statistics

# Monitor for unexpected reboots in system logs
show log system subtype eq reboot