What’s Vulnerable › Vulnerabilities

CVE-2024-9471: PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-09 · updated 2026-06-17
• Weakness: CWE-269

Description

A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.

Affected products

• Palo Alto Networks PAN-OS: from 9.0.0 before 10.0.0; from 10.1.0 before 10.1.11; from 10.2.0 before 10.2.8; from 11.0.0 before 11.0.3 — fixed in 10.0.0, 10.1.11, 10.2.8, 11.0.3
• Palo Alto Networks PAN-OS: from 11.0.0 before 11.0.3; from 10.1.0 before 10.1.11; from 10.2.0 before 10.2.8; 9.1, 9.0 — fixed in 11.0.3, 10.1.11, 10.2.8
• Palo Alto Networks PAN-OS: from 11.0.0 before 11.0.3; from 10.1.0 before 10.1.11; from 10.2.0 before 10.2.8; 9.1, 9.0 — fixed in 11.0.3, 10.1.11, 10.2.8

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.0.0, 10.1.11, 10.2.8, 11.0.3; Palo Alto Networks PAN-OS 11.0.3, 10.1.11, 10.2.8; Palo Alto Networks PAN-OS 11.0.3, 10.1.11, 10.2.8. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2024-9471

Get alerted when CVE-2024-9471 or the next vulnerability affects your stack