CVE-2017-15944Known exploitationPublic exploitNetwork attack vector

Unauthenticated root execution via unquoted cron filenames

Published Dec 11, 2017 · Updated Oct 21, 2025

PAN-OS and Panorama management flaws allow remote attackers to execute code as root through crafted web requests. Malformed session data bypasses panCheckSessionExpired, Administrator.get inserts unchecked input into XML to create directories, and genindex.sh passes attacker-controlled filenames unquoted to find, enabling command execution. The chain requires access to the web management interface and execution of the scheduled indexing job; Palo Alto Networks states that PAN-OS 8.0 is not remotely exploitable without authentication through this vulnerability.

CVSS severity9.8

Critical

EPSS probability98.34%

Next 30 days · Nov 1, 2026

Known exploitationReported

Based on sourced intelligence

Hinoki checkNot available

Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Summary

What happened

The record

CVE: CVE-2017-15944
Published: Dec 11, 2017
Updated: Oct 21, 2025

Vendor: Unknown vendor
Product: Unknown product
Classifications: CWE-119, CWE-20, T1059.004, T1190

Attack vector: network
Privileges: unauthenticated

Timeline

How it unfolded

Dec 11, 2017CVE publishedPublication date reported by the CVE source.
Oct 21, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Affected buildAffected product and version details are unavailable.

What conditions does exploitation require?

Attack vectornetwork

Required privilegesunauthenticated

What is affected?

Affected products and versions are unavailable in this record.

Published CVSS scores

9.8Palo Alto NetworksCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8NIST NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Activity data is delayed. The latest report is Sep 28, 2026.

Daily unique IPsShadowserver observations through Sep 28, 2026. Gaps indicate unavailable data.

Sep 22, 2026Sep 28, 2026

View daily counts

Reporting day	Unique IPs
Sep 22, 2026	10
Sep 23, 2026	7
Sep 24, 2026	17
Sep 25, 2026	17
Sep 26, 2026	5
Sep 27, 2026	14
Sep 28, 2026	10

Latest reporting daySep 28, 2026

Latest daily unique IPs10

Prior 30-day averageUnavailable

SourceShadowserver honeypots (KEV)

Vectornetwork

Privilegesunauthenticated

Known exploitationReported

Public exploitPublished

Weakness, pattern, technique

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-20Improper Input Validation

T1059.004Unix Shell

T1190Exploit Public-Facing Application

Public exploit references

Fake Cookie Injection PoCproof of concept · demonstrated
readSessionVarsFromFile session corruption Metasploit modulefunctional · unverified
Root remote code execution disclosure and demonstrationproof of concept · demonstrated

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Reported exploitation

CISA Known Exploited Vulnerabilities catalog inclusionknown exploited catalog

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Get started to see how Hinoki identifies affected software and validates exploitability in your environment.