CVE-2024-3383: PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-282

Description

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.

Affected products

Palo Alto Networks PAN-OS: from 10.1.0 before 10.1.11; from 10.2.0 before 10.2.5; from 11.0.0 before 11.0.3 — fixed in 10.1.11, 10.2.5, 11.0.3
Palo Alto Networks PAN-OS: from 11.0.0 before 11.0.3; from 10.2.0 before 10.2.5; from 10.1.0 before 10.1.11 — fixed in 11.0.3, 10.2.5, 10.1.11

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.1.11, 10.2.5, 11.0.3; Palo Alto Networks PAN-OS 11.0.3, 10.2.5, 10.1.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3383 or the next vulnerability affects your stack