PAN-OS Flaw (CVE-2025-4619) Allows Unauthenticated Firewall Reboot via Single Crafted Packet

PAN-OS CVE-2025-4619 is a denial-of-service vulnerability that allows an unauthenticated attacker to reboot a firewall by sending a single specially crafted packet through the dataplane. The flaw affects several PAN-OS versions used on PA-Series, VM-Series and Prisma Access firewalls and can be triggered without authentication, with repeated attempts potentially forcing the device into maintenance mode.

According to Palo Alto Networks, the issue is only applicable to firewalls where URL proxy or any decrypt-policy is configured, and Cloud NGFW deployments are unaffected. The advisory lists fixes across PAN-OS 11.2, 11.1 and 10.2, including 11.2.4-h4, 11.2.5 or later; 11.1.6-h1, 11.1.7 or higher; and 10.2.13-h3, 10.2.14 or later, with Prisma Access receiving corresponding hotfix paths. As of publication, Palo Alto Networks reports no evidence of real-world abuse.