What’s Vulnerable › Vulnerabilities

CVE-2024-9474: PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-11-18
• EPSS: 93.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-18 · updated 2026-08-04
• Weakness: CWE-78

Description

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Summary

CVE-2024-9474 is an OS command injection flaw in the Palo Alto Networks PAN-OS management web interface that lets an authenticated administrator escalate to root privileges on the firewall. It is rated 7.2 (high), listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and a public exploit exists; EPSS puts 30-day exploitation probability at 93.8%. Affected is PAN-OS, fixed in 10.1.14, 10.2.12, 11.0.6 and 11.1.5; Cloud NGFW and Prisma Access are not impacted. Upgrade to a fixed release and never expose management interfaces to untrusted networks, including the internet.

CVE-2024-9474 هو ثغرة حقن أوامر في نظام التشغيل داخل واجهة الإدارة على الويب في Palo Alto Networks PAN-OS، وتتيح لمدير يملك صلاحية الوصول إلى الواجهة تنفيذ إجراءات على الجدار الناري بصلاحيات root. صُنّفت بدرجة 7.2 (عالية)، وهي مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويوجد استغلال عام، وتبلغ احتمالية الاستغلال خلال 30 يوماً وفق EPSS نسبة 93.8%. المنتج المتأثر هو PAN-OS، وقد تمت المعالجة في الإصدارات 10.1.14 و10.2.12 و11.0.6 و11.1.5، بينما لا تتأثر Cloud NGFW وPrisma Access. يجب الترقية إلى إصدار مُعالج وعدم تعريض واجهات الإدارة للشبكات غير الموثوقة بما فيها الإنترنت.

Affected products

• Palo Alto Networks PAN-OS: from 10.1.0 before 10.1.14; from 10.2.0 before 10.2.12; from 11.0.0 before 11.0.6; from 11.1.0 before 11.1.5; from 11.2.0 before 11.2.4; 10.1.14-h2, 10.1.14-h4, 10.2.12-h1 — fixed in 10.1.14, 10.2.12, 11.0.6, 11.1.5, 11.2.4
• Palo Alto Networks PAN-OS: from 11.2.0 before 11.2.4-h1; from 11.1.0 before 11.1.5-h1; from 11.0.0 before 11.0.6-h1; from 10.2.0 before 10.2.12-h2; from 10.1.0 before 10.1.14-h6 — fixed in 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2, 10.1.14-h6
• Palo Alto Networks PAN-OS: from 11.2.0 before 11.2.4-h1; from 11.1.0 before 11.1.5-h1; from 11.0.0 before 11.0.6-h1; from 10.2.0 before 10.2.12-h2; from 10.1.0 before 10.1.14-h6 — fixed in 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2, 10.1.14-h6

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.1.14, 10.2.12, 11.0.6, 11.1.5; Palo Alto Networks PAN-OS 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2; Palo Alto Networks PAN-OS 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2024-9474
• https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/
• https://github.com/k4nfr3/CVE-2024-9474
• https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474

Get alerted when CVE-2024-9474 or the next vulnerability affects your stack