{"id":"CVE-2017-15944","kind":"vulnerability","aliases":["CVE-2017-15944"],"related":[],"title":"paloaltonetworks pan-os: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows…","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","summary":"Palo Alto Networks PAN-OS, the firewall operating system, contains unspecified flaws that can be chained for remote code execution. An attacker who chains them can run commands on the device, which sits on the network edge.","severity":"critical","cvss":9.8,"epss":0.9834,"exploited":true,"exploited_at":"2022-08-18T00:00:00+00:00","products":[{"name":"Palo Alto Networks PAN-OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["6.1.19"],"affected":"< 6.1.19","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["7.0.19"],"affected":">= 7.0.0, < 7.0.19","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["7.1.14"],"affected":">= 7.1.0, < 7.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["8.0.6"],"affected":">= 8.0.0, < 8.0.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","palo-alto","pan-os","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the PAN-OS version on the device (Device > Software or 'show system info') and compare it with the vendor advisory for CVE-2017-15944.","fix":"Apply the vendor's PAN-OS update as CISA required; the fixed version is not stated in the sources.","status":"open","published_at":"2017-12-11T17:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:58+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:10:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's PAN-OS update as CISA required; the fixed version is not stated in the sources.\nunknown","reach":"network","impact":"high","summary":"Palo Alto Networks PAN-OS, the firewall operating system, contains unspecified flaws that can be chained for remote code execution. An attacker who chains them can run commands on the device, which sits on the network edge.","category":"infrastructure","who_cares":["palo-alto","pan-os","firewall","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code on the firewall after chaining flaws","analyst_note":"Find the vendor advisory and affected/fixed PAN-OS versions and the required network exposure, since the sources give only the KEV entry and EPSS score.","how_to_check":"Check the PAN-OS version on the device (Device > Software or 'show system info') and compare it with the vendor advisory for CVE-2017-15944.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2845,"output_tokens":403,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15944':29A,32A '-2017':28A,31A '6.1.19':12A,112C '7.0':13A,113C '7.0.19':16A,116C '7.1':17A,117C '7.1.14':20A,120C '8.0':22A,122C '8.0.6':25A,125C 'allow':26A,126C 'alto':6A,34A,60B,68B,106C 'arbitrari':131C 'attack':89B,128C 'chain':83B,91B 'code':86B,132C 'command':95B 'contain':77B 'cve':27A,30A 'devic':98B 'edg':104B 'execut':87B,130C 'exploit':55B 'firewal':56B,74B 'flaw':79B 'host':66B 'infrastructur':57B 'interfac':138C 'involv':135C 'manag':137C 'network':7A,69B,103B,107C 'networks':35A 'oper':75B 'os':4A,10A,38A,42A,46A,50A,54A,63B,72B,110C 'palo':5A,33A,59B,67B,105C 'palo-alto':58B 'paloaltonetwork':1A 'paloaltonetworks':39A,43A,47A,51A 'pan':3A,9A,37A,41A,45A,49A,53A,62B,71B,109C 'pan-o':2A,8A,61B,70B,108C 'pan-os':36A,40A,44A,48A,52A 'remot':85B,127C 'run':94B 'self':65B 'self-host':64B 'sit':100B 'system':76B 'unspecifi':78B 'vector':134C 'via':133C 'x':14A,18A,23A,114C,118C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-12-11T17:29:00+00:00","kev":{"dateAdded":"2022-08-18","dueDate":"2022-09-08","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-15944","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-15944","severity":null,"published_at":"2022-08-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2017-15944","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-15944","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-15944","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15944","severity":null,"published_at":"2017-12-11T17:29:00+00:00","modified_at":"2026-06-17T01:08:31+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}