Palo Alto PAN-OS Flaw Lets Attackers Force Firewall Reboots via Malicious Packets

Palo Alto Networks has disclosed a denial-of-service vulnerability in its PAN-OS software that lets attackers force firewalls into unexpected reboots by sending malicious packets, with the flaw tracked as CVE-2025-4619. The issue affects multiple PAN-OS versions on PA-Series and VM-Series firewalls, as well as Prisma Access deployments, and can be exploited by unauthenticated attackers through the data plane.

According to Palo Alto Networks’ security advisory published on 12 November 2025, the vulnerability affects firewalls configured with URL proxy functionality or a decrypt policy, and can be exploited even when traffic does not match explicit decrypt or no-decrypt policies. The CVSS score is 6.6 (Medium) under CVSS 4.0, with a base score of 8.7, and the flaw is described as having a high availability impact and low attack complexity.

Remediation requires upgrading PAN-OS 11.2 to 11.2.2-h2, 11.2.3-h6, 11.2.4-h4, or 11.2.5 and later, and PAN-OS 11.1 to 11.1.2-h18 or later; PAN-OS 12.1 updates are not affected. Exploitation needs no user interaction, and the advisory notes no evidence of active exploitation at the time.