⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.. Due date: 2024-04-19.

CVE-2024-3400PAN-OS RCE: Improper Input Validation in PAN-OS GlobalProtect

Severity
10.0CRITICALNVD
EPSS
94.3%
top 0.06%
CISA KEV
KEVRansomware
Added 2024-04-12
Due 2024-04-19
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedApr 12
KEV addedApr 12
KEV dueApr 19
Latest updateJan 12
CISA Required Action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages5 packages

CVEListV5palo_alto_networks/pan-os10.2.010.2.9-h1+2
NVDpaloaltonetworks/pan-os18 versions+17
Palo Altopaloalto/pan-os

🔴Vulnerability Details

3
CVEList
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect2024-04-12
GHSA
GHSA-v475-xhc9-wfxg: A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature2024-04-12
VulnCheck
Palo Alto Networks PAN-OS Command Injection Vulnerability2024

💥Exploits & PoCs

2
Exploit-DB
Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation2024-04-21
Nuclei
GlobalProtect - OS Command Injection

🔍Detection Rules

3
Suricata
ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Directory Traversal in Session Cookie (CVE-2024-3400)2025-10-02
Suricata
ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Session Cookie Command Injection Attempt (CVE-2024-3400)2024-04-16
Suricata
ET MALWARE Possible UPSTYLE Command Attempt2024-04-12

📋Vendor Advisories

2
CISA
Palo Alto Networks PAN-OS Command Injection Vulnerability2024-04-12
Palo Alto
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect2024-04-12

🕵️Threat Intelligence

13
Bleepingcomputer
CISA urges devs to weed out OS command injection vulnerabilities2024-07-10
Volexity
Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices2024-05-15
Volexity
Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices2024-05-15
Bleepingcomputer
22,500 Palo Alto firewalls &quot;possibly vulnerable&quot; to ongoing attacks2024-04-19
Bleepingcomputer
Exploit released for Palo Alto PAN-OS bug used in attacks, patch now2024-04-16

📐Framework References

2
ATT&CK
UPSTYLE
ATT&CK
Operation MidnightEclipse

💬Community

1
HackerOne
GlobalProtect - OS Command Injection #█████████2026-01-12