---
id: "CVE-2024-3400"
kind: "vulnerability"
aliases: ["CVE-2024-3400"]
title: "paloaltonetworks pan-os: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Palo Alto Networks PAN-OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.2", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.2", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "globalprotect", "infrastructure", "palo-alto", "pan-os", "ransomware"]
not_affected_if: ["fixed-version", "globalprotect-disabled"]
published_at: "2024-04-12T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3400", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# paloaltonetworks pan-os: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto…

PAN-OS, the operating system on Palo Alto Networks firewalls, has a command injection flaw in its GlobalProtect feature. An unauthenticated remote attacker can run commands as root on the firewall.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Palo Alto Networks PAN-OS affected ? fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.0 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.1 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.2 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.3 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.4 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.5 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.6 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.7 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.8 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.9 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.0 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.1 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.2 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.3 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.4 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.0 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.1 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.2 fixed ?

## Fix

Apply the vendor mitigation or patch per the Palo Alto Networks bulletin; enable Threat Prevention IDs as an interim step if the vendor advises it. Exact fixed versions are not in the sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3400
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-3400

## From the sources

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

CISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_