CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 12 Apr 2024, the same day the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 10.0 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline 19 Apr 2024. Apply mitigations per vendor instructions as they become available. Full text
- Which versions are affected?
Affected
- from 10.2.0 to before 10.2.9-h1
- from 11.0.0 to before 11.0.4-h1
- from 11.1.0 to before 11.1.2-h3
Unaffected 9.0.0; 9.1.0; 10.0.0; 10.1.0; from 10.2.9-h1; from 11.0.4-h1; and 3 more
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
CISA due date for this action: 19 April 2024.
Solution (from the CVE record)
We strongly advise customers to immediately upgrade to a fixed version of PAN-OS to protect their devices even when workarounds and mitigations have been applied. This issue is fixed in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. Customers who upgrade to these versions will be fully protected.
Workaround (from the CVE record)
Recommended Mitigation: Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat IDs 95187, 95189, and 95191 (available in Applications and Threats content version 8836-8695 and later). Please monitor this advisory and new Threat Prevention content updates for additional Threat Prevention IDs around CVE-2024-3400. To apply the Threat IDs, customers must ensure that vulnerability protection has been applied to their GlobalProtect interface to prevent exploitation of this issue on their device. Please see https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184 for more information.
Advisories and patches
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | 9.0.0 |
| Unaffected | 9.1.0 |
| Unaffected | 10.0.0 |
| Unaffected | 10.1.0 |
| Affected | from 10.2.0 to before 10.2.9-h1 |
| Unaffected | from 10.2.9-h1 |
| Affected | from 11.0.0 to before 11.0.4-h1 |
| Unaffected | from 11.0.4-h1 |
| Affected | from 11.1.0 to before 11.1.2-h3 |
| Unaffected | from 11.1.2-h3 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Unaffected | All |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Unaffected | All |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 9.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities (KEV) catalog on 12 Apr 2024.
- CISA marks it as known to be used in ransomware campaigns.
- The due date CISA sets for the required action is 19 Apr 2024.
- The CVE record was published on 12 Apr 2024, the same day it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 10.0 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-20: Improper Input Validation
Attack patterns (CAPEC)
- CAPEC-248: Command Injection
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 12 Apr 2024 | CVE record published |
| 12 Apr 2024 | Added to CISA KEV |
| 19 Apr 2024 | CISA due date for the required action |
| 21 Oct 2025 | CVE record last updated |
References
More exploited Palo Alto Networks vulnerabilities
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2024-3393: Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability