{"id":"CVE-2024-3400","kind":"vulnerability","aliases":["CVE-2024-3400"],"related":[],"title":"paloaltonetworks pan-os: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto…","description":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.\n\nCISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","summary":"PAN-OS, the operating system on Palo Alto Networks firewalls, has a command injection flaw in its GlobalProtect feature. An unauthenticated remote attacker can run commands as root on the firewall.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-04-12T00:00:00+00:00","products":[{"name":"Palo Alto Networks PAN-OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.2","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.3","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.2","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.3","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","globalprotect","infrastructure","palo-alto","pan-os","ransomware"],"not_affected_if":["fixed-version","globalprotect-disabled"],"how_to_check":null,"fix":"Apply the vendor mitigation or patch per the Palo Alto Networks bulletin; enable Threat Prevention IDs as an interim step if the vendor advises it. Exact fixed versions are not in the sources.","status":"open","published_at":"2024-04-12T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:51+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:00:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per the Palo Alto Networks bulletin; enable Threat Prevention IDs as an interim step if the vendor advises it. Exact fixed versions are not in the sources.","reach":"internet","impact":"high","summary":"PAN-OS, the operating system on Palo Alto Networks firewalls, has a command injection flaw in its GlobalProtect feature. An unauthenticated remote attacker can run commands as root on the firewall.","category":"infrastructure","who_cares":["palo-alto","pan-os","globalprotect","firewall"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains root code execution on the firewall appliance","analyst_note":"Find the affected and fixed PAN-OS versions and the GlobalProtect configuration that exposes it in the Palo Alto Networks security advisory for CVE-2024-3400, and confirm the Threat Prevention ID mitigation details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["globalprotect-disabled","fixed-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000501,"input_tokens":2892,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':24A,27A '-3400':25A,28A 'action':179C 'affect':195C 'allow':164C 'alto':22A,30A,113B,126B,151C 'appli':180C 'arbitrari':12A 'attack':141B,167C 'avail':188C,202C 'becom':187C 'bulletin':209C 'cisa':177C 'command':6A,131B,144B,160C,170C 'contain':158C 'creation':14A 'cve':23A,26A 'detail':212C 'devic':196C 'enabl':198C 'execut':169C 'exploit':107B 'featur':19A,137B,157C 'file':13A 'firewal':108B,128B,149B,176C 'flaw':133B 'globalprotect':18A,109B,136B,156C 'id':201C 'infrastructur':110B 'inject':7A,132B,161C 'instruct':184C 'mitig':181C 'network':127B,152C 'networks':31A 'oper':122B 'os':4A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,90A,94A,98A,102A,106A,116B,120B,155C 'otherwis':189C 'palo':21A,29A,112B,125B,150C 'palo-alto':111B 'paloaltonetwork':1A 'paloaltonetworks':35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A,95A,99A,103A 'pan':3A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,89A,93A,97A,101A,105A,115B,119B,154C 'pan-o':2A,114B,118B,153C 'pan-os':32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,92A,96A,100A,104A 'patch':215C 'per':182C 'prevent':200C 'privileg':173C 'ransomwar':117B 'releas':216C 'remot':140B 'requir':178C 'result':10A 'root':146B,172C 'run':143B 'schedul':217C 'see':206C 'system':123B 'threat':199C 'unauthent':139B,166C 'user':190C 'vendor':183C,205C,208C 'version':193C 'vulner':15A,162C,192C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-12T00:00:00+00:00","kev":{"dateAdded":"2024-04-12","dueDate":"2024-04-19","requiredAction":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-3400","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3400","severity":null,"published_at":"2024-04-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-3400","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3400","severity":null,"published_at":"2024-04-12T08:15:06+00:00","modified_at":"2026-06-17T07:44:11+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}