CVE-2017-15944: Palo Alto Networks PAN-OS Remote Code Execution

Source-specific exposure conditions

• The device runs an affected PAN-OS release: 6.1.18 or earlier; 7.0.18 or earlier; 7.1.13 or earlier; or 8.0.x before 8.0.6.
• The management interface is reachable by an attacker. Palo Alto Networks states that exploitation occurs through the device management interface and can occur before authentication.
• The vulnerable device or management interface is insufficiently isolated from untrusted or broadly reachable networks.

Source-specific remediation

• Upgrade PAN-OS to at least 6.1.19, 7.0.19, 7.1.14, or 8.0.6, according to the installed release branch and vendor support guidance.
• Until software updates are applied, isolate the management interface and restrict access to authorized security-administration personnel using network segmentation or PAN-OS IP access-control restrictions.
• Apply Palo Alto Networks content update 756 with vulnerability signatures 40483 and 40484 as an interim mitigation, ensuring the signatures are applied to a firewall rule protecting traffic destined for the management interface.
• Where applicable, use Panorama for centralized administration and disable HTTP/HTTPS management access on vulnerable appliances, consistent with the vendor's stated mitigation guidance.
• Because the CVE is listed in CISA's Known Exploited Vulnerabilities Catalog, investigate relevant devices for signs of unauthorized access or compromise in accordance with incident-response procedures.

Source-specific verification

• Identify the running PAN-OS or Panorama release through the normal administrative interface or approved asset-inventory process.
• Confirm the installed release is at or above the vendor's unaffected threshold: 6.1.19, 7.0.19, 7.1.14, or 8.0.6, as applicable.
• Confirm that management-interface access is restricted to authorized administration networks or addresses and is not broadly reachable from untrusted networks.
• If interim signatures were used, confirm through the normal administrative interface that content update 756 and signatures 40483 and 40484 are installed and associated with the management-interface protection policy.
• Do not use exploit payloads or active exploitation tests for verification.

Uncertainty and evidence gaps

• The supplied source record contains a generic affected-data entry with product and version listed as n/a; the product, version ranges, exposure condition, fixes, and mitigations are instead supported by the Palo Alto Networks advisory and NVD.
• The vendor advisory states that PAN-OS 8.0 was not remotely exploitable by an unauthenticated user using this vulnerability, while also noting that PAN-OS 8.0.6 includes related patches. Apply the vendor's branch-specific guidance rather than inferring exploitability solely from the CPE range.
• No device inventory, running version, management-interface exposure, patch state, or compromise status was provided.

Claim-to-source evidence

• Affected Product: The vulnerability affects PAN-OS and Panorama on the management interface. Evidence
• Affected Version: Palo Alto Networks identifies PAN-OS 6.1.18 and earlier, 7.0.18 and earlier, and 7.1.13 and earlier as affected; NVD additionally records the 8.0.x range before 8.0.6. Evidence
• Exposure: Exploitation is performed remotely through the device management interface and can result in code execution before authentication; management-interface isolation and access restriction reduce exposure. Evidence
• Fixed Version: The vendor identifies PAN-OS 6.1.19, 7.0.19, 7.1.14, and 8.0.6 as the relevant unaffected or patched thresholds. Evidence
• Remediation: The vendor recommends upgrading and describes content update 756 with signatures 40483 and 40484 as an interim mitigation for traffic destined for the management interface. Evidence
• Verification: Verification can be performed by comparing the running PAN-OS or Panorama release with the vendor's unaffected-version table and confirming management-interface isolation or access restrictions; this does not require exploit testing. Evidence

Synthesis sources

• security.paloaltonetworks.com
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-30T11:32:05Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

45e790a151291a395785de28035385b461c22dea3c41efa5b578951e0342c2d5