Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execut…

Published 8 y ago 2017-12-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

Yes

added 2022-08-18

EPSS

98.3%

percentile 100%

Public exploits

Exploit-DB

Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.

Known exploited (CISA KEV)

Added: 4 y ago 2022-08-18
Due date: 2022-09-08 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: Palo Alto Networks / PAN-OS
CISA name: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 20 mo ago 2025-02-07

Exploit prediction (EPSS)

98.34% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

EDB-44597 Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit) · remote · 2018-05-08
EDB-43342 Palo Alto Networks Firewalls - Root Remote Code Execution · remote · 2017-12-14

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-20 Improper Input Validation
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Technology feeds

Palo Alto PAN-OS (RSS, critical only)

References

exploit-db.com /exploits/44597/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
securitytracker.com /id/1040007 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/102079 · vdb-entry, x_refsource_BID, x_transferred
exploit-db.com /exploits/43342/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
security.paloaltonetworks.com /CVE-2017-15944 · x_refsource_CONFIRM, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-15944 · government-resource

Sources

CVE List: CVE-2017-15944
NVD: CVE-2017-15944

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary