A stack‑based buffer overflow in Panorama’s log processing can be triggered by malicious log data, resulting in a DoS that forces the device into maintenance mode after repeated attempts. The vulnerability is a classic buffer overflow (CWE‑754) and does not directly grant code execution or privilege escalation, but it can disrupt management traffic and the user interface for an extended period. The attack vector is likely remote, through the log ingestion or management interfaces that accept log entries, inferred from the description of log processing functionality. The impact is limited to the Panorama management plane and does not affect the underlying Cloud NGFW or Prisma Access services.

Panorama devices running Palo Alto Networks PAN‑OS versions from 11.1.0 up through 12.2.3, inclusive of all build suffixes, are vulnerable. The documented fix ranges are 12.2.4 or later, 12.1.10‑h2 or later, 12.1.7‑h8 or 12.1.10‑h2 or later, 12.1.4‑h12 or 12.1.10‑h2 or later, 11.2.15 or later, 11.1.16‑h3 or later, and the older, unsupported branch is not recommended. Cloud‑NGFW, Prisma Access, and standalone PAN‑OS firewalls are unaffected.

The CVSS score of 4.6 indicates a moderate severity; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation is not widespread. Nonetheless, an attacker who can send crafted log entries to Panorama could repeatedly trigger the overflow, eventually causing network management downtime. The requirement for repeated attempts implies that the attack would leave detectable logs, but the potential service disruption makes prompt remediation important.