{"id":"CVE-2017-15944","published":"2017-12-11T17:29:00Z","modified":"2026-06-17T01:08:31Z","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"description":{"text":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","provenance":"source","from":"NVD"},"summary":{"text":"A remote code execution flaw in Palo Alto Networks PAN-OS, affecting versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6, lies in the management interface. An unauthenticated remote attacker can execute arbitrary code by sending crafted input to the management interface, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9834,"percentile":0.99917,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-08-18","dueDate":"2022-09-08","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://security.paloaltonetworks.com/CVE-2017-15944; https://nvd.nist.gov/vuln/detail/CVE-2017-15944","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-18","exploitedFirstSeen":"2022-08-18","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2017-15944","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2017-15944","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-03&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-20&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2017-15944","date":"2024-01-25"}],"evidenceTotal":822,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://www.securityfocus.com/bid/102079","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040007","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://security.paloaltonetworks.com/CVE-2017-15944","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/43342/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44597/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/102079","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040007","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://security.paloaltonetworks.com/CVE-2017-15944","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/43342/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44597/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-15944","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote exploit of exposed management interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via vectors involving the management interface","start":106,"end":202}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution on appliance","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":106,"end":155}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-7360","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7360","exploited":true,"exploitedSince":"2022-08-18","provenance":"source"},"exploits":[{"id":43342,"url":"https://www.exploit-db.com/exploits/43342","title":"Palo Alto Networks Firewalls - Root Remote Code Execution","type":"remote","platform":"hardware","date":"2017-12-14","verified":true,"provenance":"source"},{"id":44597,"url":"https://www.exploit-db.com/exploits/44597","title":"Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)","type":"remote","platform":"unix","date":"2018-05-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-12-14"},"pocGithub":{"count":3,"skipped":1,"earliest":"2017-12-19","earliestUrl":"https://github.com/xxnbyy/CVE-2017-15944-POC","repos":[{"name":"surajraghuvanshi/PaloAltoRceDetectionAndExploit","url":"https://github.com/surajraghuvanshi/PaloAltoRceDetectionAndExploit","stars":6,"created":"2018-05-24"},{"name":"xxnbyy/CVE-2017-15944-POC","url":"https://github.com/xxnbyy/CVE-2017-15944-POC","stars":2,"created":"2017-12-19"},{"name":"P4x1s/PaloAlto_EXP","url":"https://github.com/P4x1s/PaloAlto_EXP","stars":0,"created":"2023-02-15"}]},"metasploit":[{"name":"Palo Alto Networks readSessionVarsFromFile() Session Corruption","module":"exploit/linux/http/panos_readsessionvars","type":"exploit","disclosureDate":"2017-12-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_readsessionvars.rb"}],"nuclei":[{"id":"CVE-2017-15944","name":"Palo Alto Network PAN-OS - Remote Code Execution","severity":"critical","path":"http/cves/2017/CVE-2017-15944.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15944.yaml"}],"first":{"date":"2017-12-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_readsessionvars.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/43342/","https://www.exploit-db.com/exploits/44597/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2017-12-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15944","provenance":"source"},{"date":"2017-12-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2017-12-14, PoC-in-GitHub 2017-12-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_readsessionvars.rb","provenance":"source"},{"date":"2022-08-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-08-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7360","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1711},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1535 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-palo-alto-networks-pan-os-cwe-20"}}