CVE-2025-4619 – Palo Alto Networks PAN-OS Denial-of-Service Vulnerability Allowing Firewall Reboot

Vulnerability

Patched

A denial-of-service vulnerability has been identified in Palo Alto Networks PAN-OS software. This vulnerability allows an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. When the reboot is initiated repeatedly, the firewall enters maintenance mode. This issue affects PA-Series firewalls, VM-Series firewalls, and Prisma Access software, but does not impact Cloud NGFW. The vulnerability is present in PAN-OS versions 10.2, 11.1, and 11.2, with specific subversion ranges applicable.

Impact

Exploitation of this vulnerability causes the firewall to reboot and enter maintenance mode.

Remediation

Users can upgrade to PAN-OS 11.2.4-h4 or 11.2.5, or to PAN-OS 10.2.13-h3 or 10.2.14. For Prisma Access, upgrade to 11.2.4-h4 or 10.2.10-h14. Users on older, unsupported PAN-OS versions should upgrade to a supported fixed version.

Added: Nov 13, 2025, 9:19 PM

Updated: Nov 13, 2025, 9:19 PM

Affected Products

Palo Alto Networks PAN-OS

Moderate fix21 remedies

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*

Moderate fix21 remedies

>= 11.2.0, < 11.2.5
>= 11.2.4, < 11.2.4-h4
>= 11.2.3, < 11.2.3-h6
>= 11.2.2, < 11.2.2-h2
>= 11.1.0, < 11.1.7
>= 11.1.6, < 11.1.6-h1
>= 11.1.4, < 11.1.4-h13
>= 11.1.4, < 11.1.4-h4
>= 11.1.3, < 11.1.3-h2
>= 11.1.2, < 11.1.2-h18
>= 11.1.2, < 11.1.2-h9
>= 10.2.0, < 10.2.14
>= 10.2.13, < 10.2.13-h3
>= 10.2.12, < 10.2.12-h6
>= 10.2.11, < 10.2.11-h12
>= 10.2.10, < 10.2.10-h14
>= 10.2.10, < 10.2.10-h2
>= 10.2.9, < 10.2.9-h21
>= 10.2.9, < 10.2.9-h6
>= 10.2.8, < 10.2.8-h21
>= 10.2.8, < 10.2.8-h10
>= 10.2.7, < 10.2.7-h24
>= 10.2.7, < 10.2.7-h11

CVSS Scores

volerion

6.6

CVSS 4.0

6.6

Medium

volerion

7.5

CVSS 3.1

7.5

High

Vendor

6.6

CVSS 4.0

6.6

Medium

Click a row to open the calculator.

References

https://security.paloaltonetworks.com/CVE-2025-4619

AdvisoryRemedyVendor

Showing 1-1 of 1 references

Palo Alto Networks PAN-OS Denial-of-Service Vulnerability Allowing Firewall Reboot