ZeroDay Findings
Sign inSign up

Findings

CVE-2024-3400

Palo Alto Networks PAN-OS Command Injection Vulnerability

Published Apr 12, 2024 · updated Jun 17, 2026 · paloaltonetworks pan-os

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 12, 2024 · Catalog

    Detected

    A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

  2. Apr 12, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

  3. Apr 19, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

  4. Jun 17, 2026 · Catalog

    Updated

    A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Required action

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

CISA due date Apr 19, 2024

Affected

  • cpe paloaltonetworks/pan-os10.2.0
  • cpe paloaltonetworks/pan-os10.2.1
  • cpe paloaltonetworks/pan-os10.2.2
  • vendor Palo Alto Networks PAN-OSversion unspecified

Sources

  • CISA KEVCVE-2024-3400

    Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

    cisa.gov
  • CVE.orgCVE-2024-3400

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-3400

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database51996

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/panos_telemetry_cmd_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2024-3400

    A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root

    nvd.nist.gov

References