CVE-2017-15944: PAN-OS management interface input validation flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution on a perimeter security device, listed in CISA KEV with public exploits and near-maximum EPSS.

What it is

PAN-OS versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 contain an input validation and memory buffer overflow flaw reachable through the management interface. A remote, unauthenticated attacker can execute arbitrary code, making this a critical exposure for any internet-facing management plane.

Impact

Successful exploitation gives the attacker arbitrary code execution on the firewall or management appliance, with high impact to confidentiality, integrity and availability. That level of control over a perimeter device can enable traffic manipulation, credential theft and lateral movement.

Attack surface

Reached over the network via the PAN-OS management interface; the CVSS vector indicates no privileges and no user interaction are required. The description does not specify which management services or ports are involved, so defenders should treat any reachable management plane as exposed.

Exploitation

CVE-2017-15944 is listed in CISA KEV with a 2022-08-18 addition date, and public exploit code exists per Exploit-DB references. EPSS is 0.98303 (99.9th percentile), indicating very high predicted exploitation activity.

What to do

• Upgrade PAN-OS to 6.1.19, 7.0.19, 7.1.14, 8.0.6 or later as applicable to the deployed branch.
• Restrict management interface access to dedicated internal networks or jump hosts; never expose it to the internet.
• Apply management plane access controls, allowed-IP lists and strong authentication while patching is in progress.
• Monitor vendor advisories for the affected branch and confirm no unsupported versions remain in service.
• Review firewall and management logs for unexpected access to the management interface.

Detection

• Alert on management interface connections from untrusted or external source addresses.
• Hunt for anomalous processes, shell activity or unexpected child processes on PAN-OS management plane.
• Review authentication and configuration-change logs around management interface sessions for signs of tampering.
• Correlate IDS/IPS signatures for known PAN-OS management interface exploit attempts against device logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.