Palo Alto Networks has disclosed a high-severity vulnerability in its PAN-OS software, which allows unauthenticated attackers to exploit the DNS Security feature and trigger denial-of-service (DoS) conditions on affected devices. The vulnerability, tracked as CVE-2024-3393, with a CVSS score of 8.7, is exploited by sending malicious DNS packets, causing the firewall to reboot and potentially enter maintenance mode after repeated attacks, requiring manual intervention. This issue impacts PAN-OS versions 10.X and 11.X, as well as Prisma Access devices running PAN-OS 10.2.8 and later or prior to 11.2.3, where DNS Security logging is enabled. The company has confirmed active exploitation of the flaw in the wild, with customers experiencing outages when malicious DNS packets were blocked by their firewalls. While patches have been released for most affected versions—such as PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, and 11.2.3—PAN-OS 11.0 will not receive updates due to its end-of-life status. Mitigation steps include disabling DNS Security logging temporarily or adjusting Log Severity settings, with specific instructions provided for firewalls managed via Strata Cloud Manager (SCM) or Panorama. CTIX analysts stress the importance of applying immediate updates or workarounds to protect environments from this actively exploited vulnerability.