CVE-2026-0258: PAN-OS IKEv2 SSRF Vulnerability

CVE-2026-0258 Overview

CVE-2026-0258 is a Server-Side Request Forgery (SSRF) vulnerability in the Internet Key Exchange version 2 (IKEv2) implementation of Palo Alto Networks PAN-OS® software. An unauthenticated attacker can coerce the firewall into sending network requests to unintended destinations or trigger a denial-of-service (DoS) condition. The flaw is categorized under CWE-918: Server-Side Request Forgery. Panorama, Cloud NGFW, and Prisma® Access deployments are not affected.

Critical Impact

Unauthenticated network-based attackers can abuse the IKEv2 service to issue arbitrary outbound requests from the firewall or cause a denial-of-service condition on affected PAN-OS devices.

Affected Products

• Palo Alto Networks PAN-OS® software (IKEv2 implementation)
• Firewalls configured with IKEv2 VPN functionality
• Not impacted: Panorama, Cloud NGFW, and Prisma® Access

Discovery Timeline

• 2026-05-13 - CVE-2026-0258 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0258

Vulnerability Analysis

The vulnerability resides in how the PAN-OS IKEv2 daemon processes inbound key exchange messages. IKEv2 is a protocol used to negotiate IPsec VPN tunnels and operates over UDP ports 500 and 4500. By submitting crafted IKEv2 packets, an unauthenticated remote attacker can manipulate the firewall into initiating outbound network requests to attacker-chosen destinations. The same attack surface can also be used to drive the device into a denial-of-service state, disrupting VPN connectivity and other firewall services.

The attack does not require credentials or user interaction, but the CVSS 4.0 vector indicates that successful exploitation depends on specific attack prerequisites. Confidentiality impact is limited, while availability impact on the vulnerable component is high.

Root Cause

The root cause is insufficient validation of destination identifiers parsed from IKEv2 protocol messages before the daemon performs network operations on the firewall's behalf [CWE-918]. The IKEv2 handler trusts attacker-controlled fields when constructing outbound requests, enabling redirection of those requests to internal or external endpoints the attacker selects.

Attack Vector

An attacker reaches the IKEv2 service over the network on a firewall interface that accepts IKE traffic. The attacker sends crafted IKEv2 packets that cause the firewall to either (1) issue network requests to unintended destinations, enabling reconnaissance of internal services or interaction with external endpoints from a trusted source IP, or (2) consume resources in the IKEv2 handler, producing a DoS condition. No authentication is required for either outcome. See the Palo Alto Networks Advisory for protocol-level technical details.

Detection Methods for CVE-2026-0258

Indicators of Compromise

• Unexpected outbound connections originating from firewall management or data-plane interfaces to internal hosts or unfamiliar external endpoints.
• Unexplained restarts, crashes, or resource exhaustion events in the PAN-OS IKEv2 daemon.
• Spikes in inbound IKEv2 traffic (UDP/500, UDP/4500) from untrusted sources.
• VPN tunnel negotiation failures correlated with malformed IKE_SA_INIT messages in firewall logs.

Detection Strategies

• Inspect PAN-OS system and ikemgr logs for malformed IKEv2 messages, repeated negotiation failures, and unexpected peer addresses.
• Correlate firewall-originated network flows against an allowlist of expected destinations to identify SSRF-driven requests.
• Alert on anomalous DNS queries or TCP connections sourced from firewall interfaces.

Monitoring Recommendations

• Enable verbose IKEv2 logging on internet-facing firewalls and forward logs to a centralized SIEM for retention and analysis.
• Monitor IKEv2 service availability and process restart counts as a leading indicator of DoS attempts.
• Track inbound UDP/500 and UDP/4500 source IP diversity and rate to surface scanning or exploitation attempts.

How to Mitigate CVE-2026-0258

Immediate Actions Required

• Review the Palo Alto Networks Advisory and identify PAN-OS versions running in your environment that are affected.
• Apply the vendor-supplied PAN-OS update as soon as it is available for your release train.
• Restrict IKEv2 exposure to known VPN peers using IP allowlisting on firewall interfaces and upstream network controls.
• Audit firewall-originated outbound traffic for anomalous destinations that could indicate SSRF abuse.

Patch Information

Palo Alto Networks publishes fixed PAN-OS versions and workaround guidance in its security advisory portal. Refer to the Palo Alto Networks Advisory for CVE-2026-0258 for the authoritative list of fixed releases and upgrade paths. Panorama, Cloud NGFW, and Prisma® Access do not require remediation for this issue.

Workarounds

• Limit IKEv2 reachability by applying source-IP restrictions on the firewall's IKE/IPsec service interfaces.
• Disable IKEv2 on interfaces that do not require IPsec VPN termination until a patch is applied.
• Place affected firewalls behind upstream filtering that drops IKEv2 traffic from untrusted sources.

# Example: restrict IKE/IPsec traffic to known peer addresses upstream of the firewall
# (adjust to match your environment and trusted peer list)
iptables -A FORWARD -p udp --dport 500  -s <trusted_peer_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 4500 -s <trusted_peer_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 500  -j DROP
iptables -A FORWARD -p udp --dport 4500 -j DROP