CVE-2026-0301: PAN-OS Information Disclosure Vulnerability

CVE-2026-0301 Overview

CVE-2026-0301 is an information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software. An unauthenticated attacker with network access can obtain sensitive information without user interaction. Panorama is not impacted by this vulnerability. The issue is tracked under [CWE-908: Use of Uninitialized Resource], which indicates that residual or uninitialized memory can leak into responses processed by the URL Filtering component.

Critical Impact
An unauthenticated remote attacker can retrieve limited sensitive information from PAN-OS devices with URL Filtering enabled, without requiring privileges or user interaction.

Affected Products

Palo Alto Networks PAN-OS software with the URL Filtering feature enabled
PAN-OS firewalls exposing URL Filtering to network-reachable clients
Panorama is NOT impacted by this vulnerability

Discovery Timeline

2026-08-13 - CVE CVE-2026-0301 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-0301

Vulnerability Analysis

The vulnerability resides within the URL Filtering feature of PAN-OS. URL Filtering inspects outbound web traffic and applies category-based policy decisions. A flaw in how this feature initializes or handles resources allows an unauthenticated network attacker to obtain sensitive information.

The CWE-908 classification indicates that a resource is used before being properly initialized. This typically results in residual data from previous operations being included in responses or logs accessible to the attacker. The disclosed data has limited confidentiality impact and does not affect integrity or availability.

Panorama, the centralized management platform for PAN-OS devices, is explicitly not affected. Only firewalls running PAN-OS with URL Filtering are within scope.

Root Cause

The root cause maps to [CWE-908: Use of Uninitialized Resource]. A memory buffer or data structure within the URL Filtering pipeline is read before being fully initialized. When the feature processes network-originated requests, the uninitialized region may contain fragments of previously processed data. This residual content is then exposed to the requester.

Attack Vector

Exploitation requires network access to a PAN-OS device with URL Filtering enabled. The attacker does not need credentials or user interaction. However, the CVSS v4.0 vector indicates attack requirements (AT:P) are present, meaning specific conditions must exist for the leak to occur. No public proof-of-concept or in-the-wild exploitation has been reported.

The vulnerability manifests when the URL Filtering component processes crafted or specific traffic patterns and returns memory contents that were not sanitized. See the Palo Alto Networks CVE-2026-0301 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-0301

Indicators of Compromise

Anomalous URL Filtering response payloads containing non-URL data fragments or binary content
Unexpected outbound requests from unknown or untrusted network sources probing URL Filtering endpoints
Repeated URL Filtering queries from a single source that generate unusually large or malformed responses

Detection Strategies

Monitor PAN-OS system and traffic logs for repeated URL Filtering lookups originating from unauthenticated network sources
Inspect URL Filtering telemetry for response anomalies such as inconsistent payload sizes or encoding
Correlate firewall management-plane and data-plane logs to identify probing patterns targeting URL Filtering services

Monitoring Recommendations

Forward PAN-OS logs to a centralized SIEM or data lake for continuous baseline comparison
Alert on spikes in URL Filtering query volume from external or untrusted network segments
Track access to any network interface where URL Filtering is exposed and validate against expected client inventories

How to Mitigate CVE-2026-0301

Immediate Actions Required

Review the Palo Alto Networks CVE-2026-0301 advisory for affected PAN-OS versions and fixed builds
Apply the vendor-supplied patch to all PAN-OS firewalls running the URL Filtering feature
Restrict network access to firewall interfaces so that only trusted management and traffic sources can reach the URL Filtering service
Audit exposure of PAN-OS data-plane interfaces to untrusted networks and remove unnecessary exposure

Patch Information

Palo Alto Networks has published advisory details at security.paloaltonetworks.com/CVE-2026-0301. Administrators should consult the advisory for the specific fixed PAN-OS versions and apply the upgrade path recommended by the vendor. Panorama deployments require no patch for this specific issue.

Workarounds

Limit network reachability to PAN-OS URL Filtering interfaces using upstream access control lists
Segment management and data-plane networks to reduce the population of hosts able to reach the vulnerable feature
Where feasible and consistent with operational requirements, apply vendor-recommended configuration hardening for URL Filtering until patching is complete

bash

# Configuration example
# Restrict management access to trusted subnets on PAN-OS
set deviceconfig system permitted-ip 10.0.0.0/24
commit