A denial‑of‑service flaw exists in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN‑OS. An unauthenticated attacker can send a specially crafted packet that forces the firewall to reboot. Repeated attempts can lock the device into maintenance mode, rendering it unavailable. The flaw maps to CWE‑754, which concerns the use of remote input to cause a denial of service.

Products affected are Palo Alto Networks PAN‑OS firmware versions 11.2.0 through 11.2.9 and 12.1.2 through 12.1.3. Cloud NGFW and Prisma Access are not impacted. Users running these firmware ranges should consider the vendor‑recommended updates: for PAN‑OS 12.1, upgrade to 12.1.4 or later; for PAN‑OS 11.2, upgrade to 11.2.10 or later; all older, unsupported PAN‑OS releases should be moved to a supported fixed version.

The CVSS base score of 6.6 indicates a moderate severity, and the EPSS score, while low (<1%), confirms that the vulnerability is not currently widely exploited. Because the issue requires an unauthenticated network packet, the most likely attack vector would be an insider or adversary gaining network access to the ADNS interface. Once exploited, the attacker can force ongoing reboots and lock the device, causing a denial of service. The vulnerability is not listed in the CISA KEV catalog, implying no publicly confirmed exploits at the time of writing.