---
id: "CVE-2024-3393"
kind: "vulnerability"
aliases: ["CVE-2024-3393"]
title: "A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an\u2026"
severity: "high"
cvss: 8.7
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Palo Alto Networks PAN-OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": ">= 11.1.0, <= 11.1.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.2.3"], "affected": ">= 11.2.0, < 11.2.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.10", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.11", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.2", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks prisma access", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "network-appliance", "palo-alto", "pan-os"]
not_affected_if: ["dns-security-disabled"]
published_at: "2024-12-27T10:15:17+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3393", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3393", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an…

A malformed DNS packet sent to a Palo Alto Networks PAN-OS firewall with DNS Security enabled can make the firewall reboot, and repeated attempts put it into maintenance mode. CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Palo Alto Networks PAN-OS affected ? fixed ?
- vendor:paloaltonetworks pan-os affected >= 11.1.0, <= 11.1.1 fixed ?
- vendor:paloaltonetworks pan-os affected >= 11.2.0, < 11.2.3 fixed 11.2.3
- vendor:paloaltonetworks pan-os affected = 10.1.14 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.8 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.9 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.10 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.11 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.12 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.13 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.2 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.3 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.4 fixed ?
- vendor:paloaltonetworks prisma access affected ? fixed ?

## How to check

Check whether DNS Security is enabled on the PAN-OS firewall; the sources do not give a specific command or setting path.

## Fix

Apply the mitigations in the Palo Alto Networks vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA). Fixed version: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3393
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-3393

## From the sources

Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_