Clarification Needed: PAN-OS 11.2.x Vulnerability Status and Mitigation

N.Parre — Fri, 14 Nov 2025 13:15:39 GMT

1) Version Clarification
Is PAN-OS 11.2.x (specifically 11.2.4-h1) affected by CVE-2023-48795 (Terrapin SSH Attack)? The advisory lists up to 11.1.x but does not mention 11.2.x.
2) Mitigation Confirmation
If 11.2.x is affected, does disabling chacha20-poly1305and Encrypt-then-MAC algorithms fully mitigate the risk, or is an upgrade required?
3) Hotfix Details
Does the hotfix version 11.2.4-h1 include the patch for CVE-2023-48795, or do we need to move to 11.2.4-h4 or later?4) Future Advisory Updates
Will Palo Alto update the official advisory to include PAN-OS 11.2.x status for CVE-2023-48795?
5) Best Practice
What is the recommended approach for customers running PAN-OS 11.2.x regarding Terrapin SSH vulnerability—upgrade path or configuration hardening?

Re: Clarification Needed: PAN-OS 11.2.x Vulnerability Status and Mitigation

reaper — Fri, 14 Nov 2025 13:42:38 GMT

according to https://security.paloaltonetworks.com/CVE-2023-48795

1) 11.2 is not affected

2) 11.2 is not affected so no mitigation required

3) it looks like this issue was either fully addressed by the time 11.2.0 came into GA hence the whole train is not affected, or a library causing this vulnerability in previous versions is not present in 11.2

4) according to the article, 11.2.0 is already unaffected, so later versions will also be unaffected. relapse to vulnerability in 11.2 would have been documented as such

5) if you believe the above information is incorrect, please open a support case for an authoritative answer from a source inside palo alto

topic Clarification Needed: PAN-OS 11.2.x Vulnerability Status and Mitigation in Next-Generation Firewall Discussions

Clarification Needed: PAN-OS 11.2.x Vulnerability Status and Mitigation

Re: Clarification Needed: PAN-OS 11.2.x Vulnerability Status and Mitigation