CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-11-18
EPSS: 99.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-11-18 · updated 2026-08-04
Weakness: CWE-306

Description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Summary

CVE-2024-0012 is a critical (CVSS 9.8) authentication bypass in the PAN-OS management web interface that lets an unauthenticated attacker with network access gain administrator privileges, alter configuration, or chain into other flaws such as CVE-2024-9474. It affects PAN-OS 10.2, 11.0, 11.1, and 11.2; Cloud NGFW and Prisma Access are not impacted. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS puts 30-day exploitation probability at 99.8%. Apply the vendor's fixed PAN-OS releases and never expose the management interface to untrusted networks, including the internet; restrict management access to trusted internal IP addresses per Palo Alto's best-practice guidance.

CVE-2024-0012 هو ثغرة تجاوز مصادقة حرجة (CVSS 9.8) في واجهة إدارة الويب الخاصة بـ PAN-OS، تتيح لمهاجم غير مُصادَق لديه وصول شبكي الحصول على صلاحيات مسؤول PAN-OS وتعديل الإعدادات أو استغلال ثغرات أخرى تتطلب المصادقة مثل CVE-2024-9474. تؤثر الثغرة في PAN-OS 10.2 و11.0 و11.1 و11.2 فقط، ولا تتأثر بها Cloud NGFW وPrisma Access. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 99.8%. يجب تطبيق إصدارات PAN-OS المُصلحة من المورّد وعدم تعريض واجهة الإدارة للشبكات غير الموثوقة بما فيها الإنترنت، مع تقييد الوصول إليها بعناوين IP داخلية موثوقة وفق إرشادات Palo Alto.

Affected products

Palo Alto Networks PAN-OS: 10.2.0, 10.2.0-h1, 10.2.0-h2, 10.2.0-h3, 10.2.1, 10.2.1-h1 (+111)

References

Get alerted when CVE-2024-0012 or the next vulnerability affects your stack