Untrusted network traffic can be crafted to target a PAN-OS dataplane interface; a single unauthenticated packet can trigger a DoS condition, and repeated attempts will put the firewall into maintenance mode, disrupting network services. The vulnerability is a remote denial of service that does not require authentication and can be triggered from outside the firewall.

Palo Alto Networks Cloud NGFW, PAN-OS, and Prisma Access are impacted. All PAN‑OS releases from 11.1.0 up to 12.2.3 (including the specific sub‐versions listed in the vendor advisory) are vulnerable; versions above the recommended patches are not affected. Cloud NGFW and Panorama are explicitly not affected.

The CVSS score of 6.6 indicates a moderate severity; EPSS is not available, and the vulnerability is not listed in the KEV catalog, suggesting no widespread exploitation yet. The attack vector is network‑layer traffic that an attacker can send from outside the protected network, and the risk is primarily to availability rather than confidentiality or integrity.