---
id: "CVE-2024-9474"
kind: "vulnerability"
aliases: ["CVE-2024-9474"]
title: "paloaltonetworks pan-os: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access\u2026"
severity: "high"
cvss: 7.2
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Palo Alto Networks PAN-OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.1.14"], "affected": ">= 10.1.0, < 10.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.2.12"], "affected": ">= 10.2.0, < 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.0.6"], "affected": ">= 11.0.0, < 11.0.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.1.5"], "affected": ">= 11.1.0, < 11.1.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.2.4"], "affected": ">= 11.2.0, < 11.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.0.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "palo-alto", "pan-os", "ransomware", "vpn"]
not_affected_if: ["managed-hosting", "no-pan-os-devices"]
published_at: "2024-11-18T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9474", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# paloaltonetworks pan-os: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access…

PAN-OS, the operating system on Palo Alto Networks firewalls and VPN appliances, has an OS command injection flaw in its web management interface. An attacker who can reach that interface can inject operating system commands and escalate privileges on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Palo Alto Networks PAN-OS affected ? fixed ?
- vendor:paloaltonetworks pan-os affected >= 10.1.0, < 10.1.14 fixed 10.1.14
- vendor:paloaltonetworks pan-os affected >= 10.2.0, < 10.2.12 fixed 10.2.12
- vendor:paloaltonetworks pan-os affected >= 11.0.0, < 11.0.6 fixed 11.0.6
- vendor:paloaltonetworks pan-os affected >= 11.1.0, < 11.1.5 fixed 11.1.5
- vendor:paloaltonetworks pan-os affected >= 11.2.0, < 11.2.4 fixed 11.2.4
- vendor:paloaltonetworks pan-os affected = 10.1.14 fixed ?
- vendor:paloaltonetworks pan-os affected = 10.2.12 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.0.6 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.1.5 fixed ?
- vendor:paloaltonetworks pan-os affected = 11.2.4 fixed ?

## Fix

Apply the vendor mitigations or upgrade PAN-OS per the vendor advisory; if no mitigation is available, discontinue use of the product as CISA directs.
Restrict the management interface so it is not reachable from untrusted networks, including the internet.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9474
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-9474

## From the sources

Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_