CVE-2024-3393 PAN-OS DNS Security DoS — Unauthenticated Firewall Crash Forces Maintenance Mode, Perimeter Security Collapse

CVE-2024-3393 PAN-OS DNS Security DoS (TL-2026-0112) is a high-severity software vulnerability, first published 2026-02-16. It has no confirmed attribution, references 1 CVE (CVE-2024-3393), maps to 14 MITRE ATT&CK techniques (T1046, T1133, T1190), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0112

Threat ID
TL-2026-0112
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-16
Last reviewed
2026-02-16
Attribution confidence
NONE
Motivation
DESTRUCTION
Target sectors
Technology, Government, Financial Services, Healthcare, Critical Infrastructure, Telecommunications
Target regions
Global
Detection rules
9
Indicators of compromise
21

CVE-2024-3393 is an actively exploited Denial-of-Service vulnerability in Palo Alto Networks PAN-OS DNS Security feature (CVSS 8.7). An unauthenticated attacker sends a specially crafted DNS packet through the firewall's data plane, causing it to reboot. Repeated exploitation forces the firewall into maintenance mode, disabling all network protection. Affects PA-Series, VM-Series, CN-Series, and Prisma Access.

How CVE-2024-3393 PAN-OS DNS Security DoS works

CVE-2024-3393 is a critical Denial-of-Service vulnerability in Palo Alto Networks PAN-OS software, specifically in the DNS Security feature. Published December 27, 2024, the vulnerability was discovered in production use — Palo Alto confirms customers experienced DoS when their firewalls blocked malicious DNS packets that triggered the condition.

**V1 CORRECTION: The v1 title references 'MoltBot Vulnerability Campaign.' 'MoltBot' does NOT exist in any security vendor database, Malpedia, MalwareBazaar, or any primary source. It is V1 FABRICATION. The CVE-2024-3393 vulnerability is real and actively exploited, but there is no malware called 'MoltBot' associated with it. This entry covers the verified CVE only.**

**VULNERABILITY DETAILS:** The vulnerability exists in PAN-OS's DNS Security processing pipeline. When the DNS Security feature is enabled with logging active, a specially crafted DNS packet sent through the firewall's data plane triggers an improper check for unusual or exceptional conditions (CWE-754), potentially combined with a buffer overread (CAPEC-540). This causes the firewall process to crash and the device to reboot.

**ATTACK CHARACTERISTICS:** - **Unauthenticated**: No credentials required - **Network-accessible**: Attack sent through the data plane (not management plane) - **Low complexity**: No special conditions needed beyond DNS Security being enabled with logging - **No user interaction**: Firewall processes the packet automatically - **Repeatable**: Repeated attempts force the firewall into maintenance mode, completely disabling it - **Automatable**: Palo Alto rates this as NOT automatable (requires specific packet crafting), but the exploit maturity is ATTACKED (confirmed exploitation)

**REQUIRED CONDITIONS FOR EXPOSURE:** BOTH must be true: 1. DNS Security License OR Advanced DNS Security License must be applied 2. DNS Security logging must be enabled (log-level set to anything other than 'none')

Verification via CLI: `show config merged | match log-level` — if any entries show values other than 'log-level none;', the device is vulnerable.

**AFFECTED PRODUCTS:** - PAN-OS 11.2: < 11.2.3 - PAN-OS 11.1: < 11.1.2-h16, < 11.1.3-h13, < 11.1.4-h7, < 11.1.5 - PAN-OS 10.2: >= 10.2.8 and < various hotfix versions - PAN-OS 10.1: >= 10.1.14 and < 10.1.14-h8 - Prisma Access: >= 10.2.8 on PAN-OS (multiple affected versions) - NOT affected: Cloud NGFW, Panorama M-Series, Panorama virtual appliances, PAN-OS 10.0, PAN-OS 9.1

**IMPACT — FIREWALL BECOMES THE VULNERABILITY:** This vulnerability inverts the security model: the DNS Security feature designed to PROTECT the network becomes the attack vector that DISABLES the firewall. An attacker doesn't need to bypass the firewall — they crash it. Once in maintenance mode, ALL traffic passes unprotected or is blocked entirely depending on fail-open/fail-close configuration. For organizations depending on Palo Alto as their primary perimeter defense, this is a complete security posture collapse.

**EXPLOITATION CONTEXT:** Palo Alto acknowledges 'customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.' This means the vulnerability was discovered because LEGITIMATE DNS SECURITY DETECTIONS triggered the crash — the firewall was correctly blocking malicious DNS, but the blocking process itself caused the DoS. CERT-EE (Estonia) provided forensic assistance, suggesting exploitation was observed in European network defense operations.

**WORKAROUND:** Set DNS Security log severity to 'none' in Anti-Spyware profiles. This reduces DNS Security visibility but prevents the crash. Note: this may block DNS traffic without generating log entries, creating a blind spot.

MITRE ATT&CK techniques used in TL-2026-0112

discovery

T1046 Network Service Discovery

persistence

T1133 External Remote Services

initial-access

T1190 Exploit Public-Facing Application

impact

T1489 Service Stop; T1498.001 Direct Network Flood; T1498.002 Reflection Amplification; T1499.002 Service Exhaustion Flood; T1499.003 Application Exhaustion Flood

resource-development

T1587.004 Exploits

reconnaissance

T1590.006 Network Security Appliances; T1595.002 Vulnerability Scanning

defense-impairment

T1685 Disable or Modify Tools; T1685.002 Disable or Modify Cloud Log; T1686 Disable or Modify System Firewall

Remediation for CVE-2024-3393 PAN-OS DNS Security DoS

Patches

  • PAN-OS 11.2.3
  • PAN-OS 11.1.5
  • PAN-OS 11.1.4-h7
  • PAN-OS 11.1.3-h13
  • PAN-OS 11.1.2-h16
  • PAN-OS 10.2.8-h19
  • PAN-OS 10.2.9-h19
  • PAN-OS 10.2.10-h12
  • PAN-OS 10.2.11-h10
  • PAN-OS 10.2.12-h4

Immediate actions

  • PATCH: Upgrade PAN-OS to fixed versions: 11.2.3, 11.1.5, 11.1.4-h7, 11.1.3-h13, 11.1.2-h16, 10.2.8-h19+, 10.1.14-h8+
  • WORKAROUND: Set DNS Security log severity to 'none' in all Anti-Spyware profiles (Objects → Security Profiles → Anti-Spyware → DNS Policies → DNS Security)
  • VERIFY EXPOSURE: Run CLI 'show config merged | match log-level' — if any entries show values other than 'log-level none;', device is vulnerable
  • Prisma Access: Open Palo Alto support case to request expedited upgrade or disable DNS Security logging
  • Monitor firewall stability: unexpected reboots or maintenance mode entries = possible exploitation

Workarounds

  • Set DNS Security log severity to 'none' (reduces visibility but prevents crash)
  • If using predefined Anti-Spyware profiles (Default/Strict), clone to custom profiles first before modifying
  • Note: workaround may block DNS traffic without logging — creates detection blind spot

Longer-term hardening

  • Implement firewall HA (High Availability) pairs to maintain protection during single-node crashes
  • Configure fail-close vs fail-open policy based on organizational risk tolerance
  • Deploy SNMP/syslog monitoring for firewall reboot events and maintenance mode transitions
  • Subscribe to Palo Alto security advisory feeds for rapid patch notification
  • Maintain PAN-OS on vendor-supported versions (PAN-OS 11.0 reached EOL Nov 2024, no fix provided)

CVEs associated with CVE-2024-3393 PAN-OS DNS Security DoS

CVE-2024-3393

Timeline of CVE-2024-3393 PAN-OS DNS Security DoS

  • Palo Alto Networks becomes aware of customers experiencing DoS when their firewalls block malicious DNS packets that trigger CVE-2024-3393. Vulnerability discovered through production exploitation, not research. Source: https://security.paloaltonetworks.com/CVE-2024-3393
  • Palo Alto Networks publishes security advisory for CVE-2024-3393. CVSS 8.7 (HIGH). Exploit maturity: ATTACKED. Affects PAN-OS 10.1, 10.2, 11.1, 11.2 and Prisma Access. Acknowledges CERT-EE forensic assistance. Source: https://security.paloaltonetworks.com/CVE-2024-3393
  • Palo Alto updates advisory to clarify affected products and platforms. Confirms Cloud NGFW, Panorama M-Series, and Panorama virtual appliances are NOT affected. Source: Palo Alto advisory.
  • First phase of Prisma Access upgrades for impacted customers. Palo Alto performs weekend upgrades to patch cloud-managed firewalls. Source: Palo Alto advisory.
  • Second phase of Prisma Access upgrades completed. All Prisma Access customers on affected PAN-OS versions upgraded or given workaround. Source: Palo Alto advisory.
  • Palo Alto updates advisory to clarify DNS Security configuration verification method. CLI command provided: 'show config merged | match log-level'. Source: Palo Alto advisory.
  • Palo Alto corrects PAN-OS 11.1.4 fix version to 11.1.4-h7 (previously listed incorrectly). All hotfix versions now available for 11.1 and 10.2 branches. Source: Palo Alto advisory.
  • As of 2026-05-29, CVE-2024-3393 is fully patched (PAN-OS 11.2.3/11.1.5/10.2.14/10.1.15+) with Palo Alto's advisory last updated Jan 30 2025 and no 2026 changes. The CISA KEV deadline (Jan 20 2025) long passed, it is an unattributed reboot-only DoS, and no ongoing 2025-2026 exploitation campaign is reported.

Sources cited for CVE-2024-3393 PAN-OS DNS Security DoS

More in vulnerability

Detection coverage for TL-2026-0112

As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0112 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats