{"id":"CVE-2017-15944","aliases":["EUVD-2017-7360","GHSA-9ppr-hv62-39w2"],"status":"published","title":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x...","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.9834,"percentile":0.99917,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-20"],"published":"2017-12-11T17:00:00Z","modified":"2026-06-17T01:08:31Z","kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-18"},{"source":"kev","since":"2022-08-18"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/panos_readsessionvars","title":"Palo Alto Networks readSessionVarsFromFile() Session Corruption","type":"exploit","platform":"Unix","date":"2017-12-11","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/panos_readsessionvars"},{"source":"exploitdb","id":"EDB-43342","title":"Palo Alto Networks Firewalls - Root Remote Code Execution","type":"remote","platform":"hardware","date":"2017-12-14","verified":true,"url":"https://www.exploit-db.com/exploits/43342"},{"source":"pocgithub","id":"xxnbyy/CVE-2017-15944-POC","title":"xxnbyy/CVE-2017-15944-POC","date":"2017-12-19","url":"https://github.com/xxnbyy/CVE-2017-15944-POC"},{"source":"exploitdb","id":"EDB-44597","title":"Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)","type":"remote","platform":"unix","date":"2018-05-08","verified":true,"url":"https://www.exploit-db.com/exploits/44597"},{"source":"pocgithub","id":"surajraghuvanshi/PaloAltoRceDetectionAndExploit","title":"surajraghuvanshi/PaloAltoRceDetectionAndExploit","date":"2018-05-24","url":"https://github.com/surajraghuvanshi/PaloAltoRceDetectionAndExploit"},{"source":"pocgithub","id":"yukar1z0e/CVE-2017-15944","title":"yukar1z0e/CVE-2017-15944","date":"2020-05-29","url":"https://github.com/yukar1z0e/CVE-2017-15944"},{"source":"pocgithub","id":"P4x1s/PaloAlto_EXP","title":"P4x1s/PaloAlto_EXP","date":"2023-02-15","url":"https://github.com/P4x1s/PaloAlto_EXP"},{"source":"nuclei","id":"CVE-2017-15944","title":"Palo Alto Network PAN-OS - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15944.yaml"}],"products":[{"vendor":"palo alto networks","product":"pan-os"},{"vendor":"paloaltonetworks","product":"pan-os"}],"references":[{"url":"https://www.exploit-db.com/exploits/44597/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040007","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/102079","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43342/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://security.paloaltonetworks.com/CVE-2017-15944","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-15944","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15944"},{"url":"https://www.exploit-db.com/exploits/43342"},{"url":"https://www.exploit-db.com/exploits/44597"},{"url":"https://github.com/advisories/GHSA-9ppr-hv62-39w2"}],"sources":{"cve":[{"id":"CVE-2017-15944","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","status":"published","published":"2017-12-11T17:00:00Z","modified":"2025-10-21T23:45:57.483Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20","CWE-119"],"updated_at":"2026-11-02T14:33:14.556599Z"}],"euvd":[{"id":"EUVD-2017-7360","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","status":"published","published":"2017-12-11T17:00:00Z","modified":"2025-10-21T23:45:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-08-18","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-9ppr-hv62-39w2","title":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x...","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","status":"published","published":"2022-05-13T01:28:23Z","modified":"2025-10-22T00:31:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2017-15944","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","description":"Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.","kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2017-15944","description":"Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.","status":"published","published":"2017-12-11T17:29:00.49Z","modified":"2026-06-17T01:08:31.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-119"],"updated_at":"2026-11-02T14:04:10.156892Z"}]}}