Detecting PAN-OS CVE-2026-0321 with existing telemetry

CVE-2026-0321, published 14 October 2026, lets crafted traffic trigger a denial of service through a dataplane interface and force PAN-OS into maintenance mode. With no workaround and the only signature (Threat ID 510038) requiring SSL decryption, defenders are advised to detect the attack behaviourally via forwarding collapse, interface anomalies and maintenance-mode transitions.

• CVE-2026-0321 causes dataplane DoS that forces PAN-OS into maintenance mode
• The only signature, Threat ID 510038, requires SSL decryption
• Detection relies on correlating throughput drops with maintenance-mode entries
• Fixes target PAN-OS branches 10.2, 11.1, 11.2, 12.1 and 12.2