A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial…

#!/usr/bin/env python3
# Check exposure to CVE-2026-0227 on a PAN-OS firewall via XML API.
# Usage: python3 check_cve_2026_0227.py --host fw01.example.com --api-key <KEY>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import ssl
import sys
import urllib.parse
import urllib.request
import xml.etree.ElementTree as ET

TIMEOUT = 20


def die(status, msg, code):
    print(status)
    if msg:
        print(msg)
    sys.exit(code)


def api_get(host, params):
    qs = urllib.parse.urlencode(params, safe='<>/=@[]\"\' ')
    url = f"https://{host}/api/?{qs}"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    req = urllib.request.Request(url, headers={"User-Agent": "noisgate-cve-2026-0227-checker/1.0"})
    with urllib.request.urlopen(req, context=ctx, timeout=TIMEOUT) as resp:
        return resp.read()


def get_xml_root(data):
    root = ET.fromstring(data)
    if root.get('status') == 'error':
        line = ''.join(root.itertext()).strip()
        raise RuntimeError(f"API error: {line}")
    return root


def parse_version(v):
    # Examples: 11.2.7-h4, 11.1.13, 10.2.18-h1
    v = v.strip()
    hotfix = 0
    if '-h' in v:
        base, h = v.split('-h', 1)
        try:
            hotfix = int(h)
        except ValueError:
            hotfix = 0
    else:
        base = v
    parts = base.split('.')
    if len(parts) != 3:
        raise ValueError(f"Unrecognized PAN-OS version: {v}")
    return tuple(int(x) for x in parts) + (hotfix,)


def cmp_ver(a, b):
    return (a > b) - (a < b)


def in_range(v, lo, hi=None):
    pv = parse_version(v)
    plo = parse_version(lo)
    if cmp_ver(pv, plo) < 0:
        return False
    if hi is None:
        return True
    phi = parse_version(hi)
    return cmp_ver(pv, phi) <= 0


def is_vulnerable_version(v):
    # Palo Alto advisory branch logic.
    if in_range(v, '12.1.2', '12.1.3-h2'):
        return True
    if in_range(v, '11.2.0', '11.2.4-h14'):
        return True
    if in_range(v, '11.2.5', '11.2.7-h7'):
        return True
    if in_range(v, '11.2.8', '11.2.10-h1'):
        return True
    if in_range(v, '11.1.0', '11.1.4-h26'):
        return True
    if in_range(v, '11.1.5', '11.1.6-h22'):
        return True
    if in_range(v, '11.1.7', '11.1.10-h8'):
        return True
    if in_range(v, '11.1.11', '11.1.12'):
        return True
    if in_range(v, '10.2.0', '10.2.7-h31'):
        return True
    if in_range(v, '10.2.8', '10.2.10-h30'):
        return True
    if in_range(v, '10.2.11', '10.2.13-h17'):
        return True
    if in_range(v, '10.2.14', '10.2.16-h5'):
        return True
    if in_range(v, '10.2.17', '10.2.18'):
        return True
    if in_range(v, '10.1.0', '10.1.14-h19'):
        return True
    return False


def get_version(host, api_key):
    data = api_get(host, {
        'type': 'op',
        'cmd': '<show><system><info></info></system></show>',
        'key': api_key,
    })
    root = get_xml_root(data)
    node = root.find('.//sw-version')
    if node is None or not (node.text and node.text.strip()):
        raise RuntimeError('Could not read sw-version from API response')
    return node.text.strip()


def get_device_config(host, api_key):
    xpaths = [
        "/config/devices/entry[@name='localhost.localdomain']",
        "/config/shared",
    ]
    texts = []
    for xp in xpaths:
        try:
            data = api_get(host, {
                'type': 'config',
                'action': 'show',
                'xpath': xp,
                'key': api_key,
            })
            root = get_xml_root(data)
            texts.append(ET.tostring(root, encoding='unicode'))
        except Exception:
            pass
    if not texts:
        raise RuntimeError('Could not retrieve configuration subtree(s)')
    return '\n'.join(texts)


def gp_present(config_xml):
    tags = ['global-protect-gateway', 'global-protect-portal', 'global-protect']
    low = config_xml.lower()
    return any(t in low for t in tags)


def main():
    ap = argparse.ArgumentParser(description='Check CVE-2026-0227 exposure on PAN-OS')
    ap.add_argument('--host', required=True, help='Firewall hostname or IP')
    ap.add_argument('--api-key', required=True, help='PAN-OS XML API key')
    args = ap.parse_args()

    try:
        version = get_version(args.host, args.api_key)
    except Exception as e:
        die('UNKNOWN', f'Failed to query PAN-OS version: {e}', 2)

    try:
        config_xml = get_device_config(args.host, args.api_key)
        has_gp = gp_present(config_xml)
    except Exception as e:
        # We can still make a version-only judgment, but config gating matters.
        if is_vulnerable_version(version):
            die('UNKNOWN', f'Version {version} is in an affected range, but GlobalProtect exposure could not be verified: {e}', 2)
        die('PATCHED', f'PAN-OS version {version} is outside vendor-affected ranges.', 0)

    if not is_vulnerable_version(version):
        die('PATCHED', f'PAN-OS version {version} is outside vendor-affected ranges. GlobalProtect present={has_gp}.', 0)

    if has_gp:
        die('VULNERABLE', f'PAN-OS version {version} is in an affected range and GlobalProtect configuration was detected.', 1)

    die('PATCHED', f'PAN-OS version {version} is in an affected range, but no GlobalProtect configuration was detected in the retrieved config. Validate manually if this device is Panorama-managed.', 0)


if __name__ == '__main__':
    main()