This vulnerability (CVE-2024-3386) in Palo Alto Networks PAN-OS arises from an incorrect string comparison (CWE-436) that prevents Predefined Decryption Exclusions from working as designed. As a result, traffic destined for domains that should not be excluded from decryption might be unintentionally excluded, undermining the intended decryption policy enforcement. The issue is present in PAN-OS versions 9.0.0 through 11.0.0. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory indicating remediation is currently available.

The vulnerability may cause traffic that should be decrypted according to policy to bypass decryption, potentially reducing the effectiveness of traffic inspection and security controls. There is no direct impact on confidentiality or availability, but the integrity of policy enforcement is affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review their decryption exclusion policies carefully and monitor for unexpected traffic behavior. No official fix or temporary workaround has been published by Palo Alto Networks as of the current information.