CVE-2024-3393

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 28.6%; technical severity is CVSS 8.7.

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Who should care

• Teams operating PAN-OS, Pan-os, Prisma Access
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether PAN-OS, Pan-os, Prisma Access is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Palo Alto Networks Security advisory CVE-2024-3393
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber

CWE

CWE-754

Affected versions

Palo Alto Networks PAN-OS; Paloaltonetworks Pan-os (Start Including 11.1.0, End Including 11.1.1 | Start Including 11.2.0, End Excluding 11.2.3 | Version 10.1.14 | Version 10.1.14); Paloaltonetworks Prisma Access (Version -)

Fixed versions

Paloaltonetworks Pan-os (Fixed from 11.2.3)

Published

27 December 2024

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 27 Dec 2024CVE published
2. 29 Dec 2024Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 28.6%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 74

External references

• CISA Government advisory CVE-2024-3393 ↗