CVE-2024-3384 is a high severity denial of service in Palo Alto Networks PAN-OS. It affects only specific versions and configurations, listed below. Palo Alto Networks rates it CVSS 8.2, while the NVD record shows 7.5. Palo Alto Networks lists fixes in PAN-OS 8.1.24, 9.0.17, 9.1.15-h1 and 10.0.12.
What's affected
The advisory lists PAN-OS 10.0 before 10.0.12, PAN-OS 9.1 before 9.1.15-h1, PAN-OS 9.0 before 9.0.17, and PAN-OS 8.1 before 8.1.24. It affects configurations with NTLM authentication enabled. The record says a remote attacker can reboot a firewall when it receives Windows New Technology LAN Manager packets from Windows servers, and that repeated attacks push the firewall into maintenance mode.
The advisory says Cloud NGFW, Prisma Access, and PAN-OS 10.1, 10.2, 11.0 and 11.1 are not affected. This is an older branch problem.
The weakness classes are CWE-1286, which covers improper handling of NTLM packet length data. The NVD record gives the score as 7.5. The Palo Alto Networks advisory gives 8.2. Both put it in the high band. I did not confirm why the numbers differ, so I report both. When you report this internally, say both numbers and name the source of each.
The advisory lists no workaround. It says the flaw affects configurations with NTLM authentication enabled, which you can check under Device, User Identification, User Mapping, Palo Alto Networks User-ID Agent Setup, NTLM. The impact is on availability only.
How to check if you're exposed
- Check the PAN-OS version. If you run 10.1 or later, you are not affected.
- For 8.1, 9.0, 9.1 and 10.0 branches, compare against the fixed versions above.
- In the web interface, open Device, User Identification, User Mapping, User-ID Agent Setup, NTLM and see whether NTLM is enabled.
- If NTLM is not enabled, the advisory scope does not apply to you.
What to do now
- Identify the PAN-OS version on each firewall, using the web interface dashboard or the
show system infocommand in the CLI. - Upgrade to PAN-OS 8.1.24, 9.0.17, 9.1.15-h1 or 10.0.12, or a later release on your branch. These are older branches, so also plan a move to a supported release.
- Apply any workaround the advisory lists while you wait for a change window.
- Schedule the upgrade through your normal change control, testing high availability pairs one member at a time.
- Watch device logs for unexpected restarts and system messages about maintenance mode.
- Record the advisory number and the fixed version in your vulnerability tracker.
Why it matters
The weakness is CWE-1286, improper validation of syntactic correctness of input. The firewall receives a packet that is malformed in a way the parser does not handle, and the device restarts. A restart on its own is a short outage. Repeated restarts push the device into maintenance mode, which needs a person to bring it back.
The affected branches are old. If you still run them, this advisory is one more reason to plan a move to a supported release.
Firewalls sit on the path of all traffic, which is why availability flaws in them matter more than the same flaw in an ordinary server. A device that reboots or stops forwarding takes the network segment with it. The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark the flaw as a CISA Known Exploited Vulnerability. That is a reason to patch on schedule, not a reason to wait.
Quick check
What is the fixed version for CVE-2024-3384?
The advisory lists PAN-OS 8.1.24, 9.0.17, 9.1.15-h1 and 10.0.12 as fixed, and all later versions. Confirm against the advisory before you plan the change.
Is CVE-2024-3384 exploited in the wild?
The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark it as a CISA KEV entry. Check the advisory again before your patch window, since that statement can change.
Sources
Last reviewed: 19 October 2026.
