{"id":"CVE-2024-9474","kind":"vulnerability","aliases":["CVE-2024-9474"],"related":[],"title":"paloaltonetworks pan-os: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access…","description":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","summary":"PAN-OS, the operating system on Palo Alto Networks firewalls and VPN appliances, has an OS command injection flaw in its web management interface. An attacker who can reach that interface can inject operating system commands and escalate privileges on the device.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2024-11-18T00:00:00+00:00","products":[{"name":"Palo Alto Networks PAN-OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.1.14"],"affected":">= 10.1.0, < 10.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["10.2.12"],"affected":">= 10.2.0, < 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.0.6"],"affected":">= 11.0.0, < 11.0.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.1.5"],"affected":">= 11.1.0, < 11.1.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":["11.2.4"],"affected":">= 11.2.0, < 11.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.0.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","palo-alto","pan-os","ransomware","vpn"],"not_affected_if":["managed-hosting","no-pan-os-devices"],"how_to_check":null,"fix":"Apply the vendor mitigations or upgrade PAN-OS per the vendor advisory; if no mitigation is available, discontinue use of the product as CISA directs.\nRestrict the management interface so it is not reachable from untrusted networks, including the internet.","status":"open","published_at":"2024-11-18T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:11+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:56:11Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or upgrade PAN-OS per the vendor advisory; if no mitigation is available, discontinue use of the product as CISA directs.\nRestrict the management interface so it is not reachable from untrusted networks, including the internet.","reach":"network","impact":"high","summary":"PAN-OS, the operating system on Palo Alto Networks firewalls and VPN appliances, has an OS command injection flaw in its web management interface. An attacker who can reach that interface can inject operating system commands and escalate privileges on the device.","category":"infrastructure","who_cares":["palo-alto","pan-os","firewall","vpn"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs OS commands on the firewall and escalates privileges","analyst_note":"Find the Palo Alto advisory for CVE-2024-9474 to confirm affected and fixed PAN-OS versions, the mitigation steps, and whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-pan-os-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000502,"input_tokens":2891,"output_tokens":425,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':26A,29A '-9474':27A,30A 'access':24A 'action':166C 'addit':182C 'administr':22A 'affect':187C 'allow':17A,144C 'alto':11A,32A,82B,96B,132C 'appli':167C 'applianc':101B 'attack':114B 'base':152C 'cisa':164C 'command':105B,124B,140C 'concentr':163C 'contain':137C 'cve':25A,28A 'devic':130B,188C 'discontinu':173C 'escal':7A,126B,147C 'exploit':77B 'expos':192C 'firewal':78B,98B,160C 'flaw':107B 'includ':159C,196C 'infrastructur':79B 'inject':106B,121B,141C 'instruct':171C 'interfac':112B,119B,154C,185C 'internet':198C 'manag':111B,153C,184C 'mitig':168C,179C 'network':12A,97B,133C,195C 'networks':33A 'oper':92B,122B 'os':4A,15A,21A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,85B,90B,104B,136C,139C 'palo':10A,31A,81B,95B,131C 'palo-alto':80B 'paloaltonetwork':1A 'paloaltonetworks':37A,41A,45A,49A,53A,57A,61A,65A,69A,73A 'pan':3A,14A,20A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,84B,89B,135C,157C 'pan-o':2A,13A,19A,83B,88B,134C 'pan-os':34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A 'per':169C 'privileg':6A,127B,146C 'product':158C,177C 'ransomwar':86B 'reach':117B 'requir':165C 'sever':156C 'softwar':16A 'system':93B,123B 'unavail':181C 'untrust':194C 'use':174C 'vendor':170C 'vpn':87B,100B,162C 'vulner':8A,142C 'web':110B,151C 'web-bas':150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-18T00:00:00+00:00","kev":{"dateAdded":"2024-11-18","dueDate":"2024-12-09","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-9474","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9474","severity":null,"published_at":"2024-11-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-9474","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9474","severity":null,"published_at":"2024-11-18T16:15:29+00:00","modified_at":"2026-08-04T05:16:32+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}