PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets
- Severity
- High7.5CVSS 3.1, High
- EPSS
- 0.89%
- Published
- 10 Apr 2024
- Updated
- 17 Jun 2026
Description
Title, description and vendor guidance are quoted from the source records.
A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.
Weakness: CWE-1286
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
0.89% probability of exploitation in the next 30 days (percentile 58%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 10.0 | >= 10.0.0, < 10.0.12 | 10.0.12 |
| 9.1 | >= 9.1.0, < 9.1.15-h1 | 9.1.15-h1 |
| 9.0 | >= 9.0.0, < 9.0.17 | 9.0.17 |
| 8.1 | >= 8.1.0, < 8.1.24 | 8.1.24 |
Versions not listed are stated unaffected by the vendor.
Workaround / Vendor remediation
Vendor remediation · PAN-OS
This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.15-h1, PAN-OS 10.0.12, and all later PAN-OS versions.
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC