PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic

published 2024-11-14 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-49964

cvss: 8.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected.

This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS:

* 10.2.7-h12 * 10.2.8-h10 * 10.2.9-h9 * 10.2.9-h11 * 10.2.10-h2 * 10.2.10-h3 * 10.2.11 * 10.2.11-h1 * 10.2.11-h2 * 10.2.11-h3 * 11.1.2-h9 * 11.1.2-h12 * 11.1.3-h2 * 11.1.3-h4 * 11.1.3-h6 * 11.2.2 * 11.2.2-h1

Patch / fix

fixed in 1

Palo Alto Networks PAN-OS 10.1.0, 10.2.7-h16, 10.2.8-h13, 10.2.9-14, 10.2.10-h7, 10.2.11-h4, 11.0.0, 11.1.2-h14, 11.1.3-h10, 11.2.2-h3, 11.2.3

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-11-14)

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber

Affected products

Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS
Palo Alto Networks Prisma Access

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Palo Alto PAN-OS rss critical rss

References

security.paloaltonetworks.com /CVE-2024-9472
vendor-advisory

Sources

CVE List CVE-2024-9472
NVD CVE-2024-9472

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary