CVE-2024-9468

PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

Severity: High7.5CVSS 3.1, High
EPSS: 0.41%
Published: 9 Oct 2024
Updated: 17 Jun 2026

Description

Title, description and vendor guidance are quoted from the source records.

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

Weakness: CWE-787

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.41% probability of exploitation in the next 30 days (percentile 33%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

Branch	Affected	Fixed in
11.1	>= 11.1.0, < 11.1.3	11.1.3
11.0	>= 11.0.0, < 11.0.4-h5 >= 11.0.5, < 11.0.6	11.0.4-h5 11.0.6
10.2	>= 10.2.0, < 10.2.4-h24 >= 10.2.5, < 10.2.7-h24 >= 10.2.8, < 10.2.8-h20 >= 10.2.9, < 10.2.9-h11 >= 10.2.10, < 10.2.10-h4	10.2.4-h24 10.2.7-h24 10.2.8-h20 10.2.9-h11 10.2.10-h4

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Workaround · PAN-OS

Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 94971 (introduced in Applications and Threats content version 8854).

Vendor remediation · PAN-OS

This issue is fixed in 10.2.9-h11, 10.2.10-h4, PAN-OS 10.2.11, PAN-OS 11.0.4-h5, PAN-OS 11.0.6, PAN-OS 11.1.3, and all later PAN-OS versions.

References

https://security.paloaltonetworks.com/CVE-2024-9468(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record): Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC