CVE-2024-8687: PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-11 · updated 2026-06-17
Weakness: CWE-497

Description

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Affected products

Palo Alto Networks GlobalProtect App: from 5.1.0 before 5.1.12; from 5.2.0 before 5.2.13; from 6.0.0 before 6.0.7; from 6.1.0 before 6.1.2; 6.2.0 (and their updates) — fixed in 5.1.12, 5.2.13, 6.0.7, 6.1.2
Palo Alto Networks PAN-OS: from 8.1.0 before 8.1.25; from 9.0.0 before 9.0.17; from 9.1.0 before 9.1.16; from 10.0.0 before 10.0.12; from 10.1.0 before 10.1.9; from 10.2.0 before 10.2.4 — fixed in 8.1.25, 9.0.17, 9.1.16, 10.0.12, 10.1.9, 10.2.4
Palo Alto Networks Prisma Access: all versions
Palo Alto Networks GlobalProtect App: from 5.1.0 before 5.1.12; from 5.2.0 before 5.2.13; from 6.0.0 before 6.0.7; from 6.1.0 before 6.1.2; from 6.2.0 before 6.2.1 — fixed in 5.1.12, 5.2.13, 6.0.7, 6.1.2, 6.2.1
Palo Alto Networks PAN-OS: from 11.0.0 before 11.0.1; from 10.2.0 before 10.2.4; from 10.1.0 before 10.1.9; from 10.0.0 before 10.0.12; from 9.1.0 before 9.1.16; from 9.0.0 before 9.0.17 — fixed in 11.0.1, 10.2.4, 10.1.9, 10.0.12, 9.1.16, 9.0.17
Palo Alto Networks Prisma Access: from 10.2.0 before 10.2.9 on PAN-OS — fixed in 10.2.9 on PAN-OS

How to fix

Upgrade to a fixed version: Palo Alto Networks GlobalProtect App 5.1.12, 5.2.13, 6.0.7, 6.1.2; Palo Alto Networks PAN-OS 8.1.25, 9.0.17, 9.1.16, 10.0.12; Palo Alto Networks GlobalProtect App 5.1.12, 5.2.13, 6.0.7, 6.1.2; Palo Alto Networks PAN-OS 11.0.1, 10.2.4, 10.1.9, 10.0.12; Palo Alto Networks Prisma Access 10.2.9 on PAN-OS. Check the vendor advisory for mitigations.

References

https://security.paloaltonetworks.com/CVE-2024-8687

Get alerted when CVE-2024-8687 or the next vulnerability affects your stack