RCE in PAN-OS IKEv2 Processing

Successful exploitation can allow remote unauthenticated execution of arbitrary code with elevated privileges on the firewall, giving an attacker the ability to compromise the device at a highly privileged level. Where code execution is not achieved, exploitation can still crash or destabilize the affected service and cause denial of service.

If immediate patching is not possible, reduce exposure of the IKEv2 attack surface by disabling affected IKEv2 VPN configurations where operationally feasible, especially configurations using the vulnerable PQC cipher conditions described for this issue. Restrict network reachability to VPN services to only trusted peers and minimize external exposure until patched. Prioritize internet-exposed firewalls and systems providing IKEv2 services.

Upgrade PAN-OS to a fixed release in the supported branches. Reported fixed versions include PAN-OS 12.1.4-h5 and later, 12.1.7 and later, 11.2.4-h17 and later, 11.2.7-h13 and later, 11.2.10-h6 and later, 11.2.12 and later, 11.1.4-h33 and later, 11.1.6-h32 and later, 11.1.7-h6 and later, 11.1.10-h25 and later, 11.1.13-h5 and later, 11.1.15 and later, 10.2.7-h34 and later, 10.2.10-h36 and later, 10.2.16-h7 and later, and 10.2.18-h6 and later. Organizations should validate branch-specific applicability and deploy the vendor-provided security updates on exposed firewalls.