CVE-2024-3393: Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 30 Dec 2024, 3 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 29.1%
EPSS score, percentile 98.2 of all scored records
- How severe?
- 8.7 High
CVSS v4.0 base score, given by the CNA
- What should I do?
Required action (CISA), due 20 Jan 2025: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Affected: 11.2.0 up to, not including, 11.2.3; 11.1.0 up to, not including, 11.1.2-h16; 10.2.8 up to, not including, 10.2.8-h19; from 10.2.8; 11.2.0 up to, not including, 11.2.3
Unaffected: All; from 11.2.3; from 11.1.2-h16; from 11.1.3-h13; from 11.1.4-h7; from 11.1.5; from 10.2.8-h19; from 10.2.9-h19; from 10.2.10-h12; from 10.2.11-h10; 10.2.0 up to, not including, 10.2.8; from 10.2.9-h19; from 10.2.10-h12; from 11.2.3
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 20 January 2025.
Solution (from the CVE record)
This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions. Note: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release. Prisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a support case https://support.paloaltonetworks.com/Support/Index . In addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases. Additional PAN-OS 11.1 fixes: * 11.1.2-h16 * 11.1.3-h13 * 11.1.4-h7 * 11.1.5 Additional PAN-OS 10.2 fixes: * 10.2.8-h19 * 10.2.9-h19 * 10.2.10-h12 * 10.2.11-h10 * 10.2.12-h4 * 10.2.13-h2 * 10.2.14 Additional PAN-OS 10.1 fixes: * 10.1.14-h8 * 10.1.15 Additional PAN-OS fixes only applicable to Prisma Access: * 10.2.9-h19 * 10.2.10-h12
Workaround (from the CVE record)
If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama * For each Anti-spyware profile, navigate to Objects → Security Profiles → Anti-spyware → (select a profile) → DNS Policies → DNS Security. * Change the Log Severity to "none" for all configured DNS Security categories. * Commit the changes. Remember to revert the Log Severity settings once the fixes are applied. NGFW managed by Strata Cloud Manager (SCM) You can choose one of the following mitigation options: * Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above. * Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . Prisma Access managed by Strata Cloud Manager (SCM) Until we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . If you would like to expedite the upgrade, please make a note of that in the support case.
Advisories and patches
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | All |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 11.2.0 up to, not including, 11.2.3 |
| Unaffected | from 11.2.3 |
| Affected | 11.1.0 up to, not including, 11.1.2-h16 |
| Unaffected | from 11.1.2-h16 |
| Unaffected | from 11.1.3-h13 |
| Unaffected | from 11.1.4-h7 |
| Unaffected | from 11.1.5 |
| Affected | 10.2.8 up to, not including, 10.2.8-h19 |
| Unaffected | from 10.2.8-h19 |
| Unaffected | from 10.2.9-h19 |
| Unaffected | from 10.2.10-h12 |
| Unaffected | from 10.2.11-h10 |
Versions not listed are: unaffected.
And 6 more version entries in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | 10.2.0 up to, not including, 10.2.8 |
| Affected | from 10.2.8 |
| Unaffected | from 10.2.9-h19 |
| Unaffected | from 10.2.10-h12 |
| Affected | 11.2.0 up to, not including, 11.2.3 |
| Unaffected | from 11.2.3 |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 11.2.3, 11.1.2-h16, 11.1.3-h13, 11.1.4-h7, 11.1.5, 10.2.8-h19, 10.2.9-h19, 10.2.10-h12.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2024-3393 to its Known Exploited Vulnerabilities (KEV) catalog on 30 Dec 2024.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 20 Jan 2025.
- The CVE record was published on 27 Dec 2024, 3 days before it was added to KEV.
- The CVE record carries a CVSS v4.0 base score of 8.7 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 29.1% (percentile 98.2), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-754: Improper Check for Unusual or Exceptional Conditions
Attack patterns (CAPEC)
- CAPEC-540: Overread Buffers
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 27 Dec 2024 | CVE record published |
| 30 Dec 2024 | Added to CISA KEV |
| 20 Jan 2025 | CISA due date for the required action |
| 21 Oct 2025 | CVE record last updated |
More exploited Palo Alto Networks vulnerabilities
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability