What’s Vulnerable › Vulnerabilities

CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-04-12
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-12 · updated 2026-06-17
• Weakness: CWE-20

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Summary

CVE-2024-3400 is a critical command injection flaw in the GlobalProtect feature of specific Palo Alto Networks PAN-OS versions and configurations, allowing an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not affected. The vulnerability is actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, with a public exploit available. Apply mitigations per vendor instructions as they become available, or enable the vendor-provided Threat Prevention IDs; see the vendor bulletin for patch details.

CVE-2024-3400 هو ثغرة حقن أوامر حرجة في ميزة GlobalProtect في إصدارات وإعدادات محددة من Palo Alto Networks PAN-OS، وتتيح لمهاجم غير مصادق عليه تنفيذ تعليمات برمجية عشوائية بصلاحيات root على جدار الحماية. لا تتأثر Cloud NGFW وأجهزة Panorama وPrisma Access بهذه الثغرة. الثغرة مستغلة فعلياً ومدرجة في كتالوج CISA للثغرات المعروفة الاستغلال، مع وجود استغلال عام متاح. طبّق التخفيفات وفق تعليمات المورّد عند توفرها، أو فعّل معرّفات Threat Prevention المقدمة من المورّد؛ راجع نشرة المورّد لتفاصيل الترقيع.

Affected products

• Palo Alto Networks PAN-OS: 10.2.0, 10.2.0-h1, 10.2.0-h2, 10.2.1, 10.2.1-h1, 10.2.2 (+46)

References

• https://security.paloaltonetworks.com/CVE-2024-3400
• https://unit42.paloaltonetworks.com/cve-2024-3400/
• https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
• https://security.paloaltonetworks.com/CVE-2024-3400
• https://unit42.paloaltonetworks.com/cve-2024-3400/
• https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400

Get alerted when CVE-2024-3400 or the next vulnerability affects your stack