CVE-2024-3386

PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended

State: Published
Severity: 5.3 Medium
Published: Apr 10, 2024
Updated: May 13, 2026
Reserved: Apr 5, 2024

Description

An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	palo_alto

Weaknesses

CWE-436 Interpretation Conflict

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	9.0.0 to before 9.0.17-h2Affectedfrom 9.0.17-h2Not affected 9.1.0 to before 9.1.17Affectedfrom 9.1.17Not affected 10.0.0 to before 10.0.13Affectedfrom 10.0.13Not affected 10.1.0 to before 10.1.9-h3Affectedfrom 10.1.9-h3Not affected 10.1.0 to before 10.1.10Affectedfrom 10.1.10Not affected 10.2.0 to before 10.2.4-h2Affectedfrom 10.2.4-h2Not affected 10.2.0 to before 10.2.5Affectedfrom 10.2.5Not affected 11.0.0 to before 11.0.1-h2Affectedfrom 11.0.1-h2Not affected 11.0.0 to before 11.0.2Affectedfrom 11.0.2Not affected 11.1.0Not affected
Cloud NGFWPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2024-3386

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.