8.7
High
Exploited
CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-754
Description
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud NGFW | Versions not published | |
| PAN-OS 11.2 | 11.2.0 → < 11.2.3 | 11.2.3 |
| PAN-OS 10.2 | earliest → < 10.2.0 | 10.2.0 |
References
- security.paloaltonetworks.com security.paloaltonetworks.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Cloud NGFW
The 114 CVEs of Cloud NGFW →
CVE-2026-0316
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious…
1.1
Low
CVE-2026-0317
A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only…
1.2
Low
CVE-2026-0318
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software…
4.6
Medium
CVE-2026-0319
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables…
4.9
Medium