Skip to content
Patcharo
Back to the results

Vulnerabilities

CriticalKEVRansomware

CVE-2024-3400 — PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

CVE-2024-3400 · PAN-OS · CVSS 10 · KEV

In brief

Severity · CVSS
Critical10CVSS 3.1, Critical
EPSS
100%
CISA KEV
Known exploited, listed since 12 Apr 2024
CERT-FR
No advisory or alert referenced in the catalog
Products
PAN-OS
Published · Modified
·
Last verified

Summary

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Weakness: CWE-77, CWE-20

Title, description and the vendor's statements are quoted from the CVE record; a vendor's advisory is summarised in Patcharo's words, with a link.

Affected and fixed versions

Per product and release branch, as the vendor's CVE record and official advisory state them. A fixed release is shown only when a document names it: the vendor's, or CERT-FR's for Check Point, with its source.

3 branches with a published fixed release

Palo Alto Networks PAN-OS

Source: CVE-2024-3400

  1. 11.1Approaching end of support
    Affected versions>= 11.1.0, < 11.1.2-h3
    First fixed release11.1.2-h3
  2. 11.0End of life
    Affected versions>= 11.0.0, < 11.0.4-h1
    First fixed release11.0.4-h1
  3. 10.2End of life
    Affected versions>= 10.2.0, < 10.2.9-h1
    First fixed release10.2.9-h1
  4. 10.1End of life
    Affected versionsNot affected
    First fixed release—
  5. 10.0End of life
    Affected versionsNot affected
    First fixed release—
  6. 9.1End of life
    Affected versionsNot affected
    First fixed release—
  7. 9.0End of life
    Affected versionsNot affected
    First fixed release—

Releases the vendor does not list are not affected.

Remediation

Fix available

Vendor fix

  • PAN-OS 11.111.1.2-h3
  • PAN-OS 11.011.0.4-h1
  • PAN-OS 10.210.2.9-h1

Upgrade to a fixed release listed above for your branch, or to a later fixed release the vendor explicitly supports.

We strongly advise customers to immediately upgrade to a fixed version of PAN-OS to protect their devices even when workarounds and mitigations have been applied. This issue is fixed in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. Customers who upgrade to these versions will be fully protected.

SourcePalo Alto Networks (CVE record)

Mitigation (vendor)

Recommended Mitigation: Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat IDs 95187, 95189, and 95191 (available in Applications and Threats content version 8836-8695 and later).

Full text

Please monitor this advisory and new Threat Prevention content updates for additional Threat Prevention IDs around CVE-2024-3400. To apply the Threat IDs, customers must ensure that vulnerability protection has been applied to their GlobalProtect interface to prevent exploitation of this issue on their device. Please see https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184 for more information.

SourcePalo Alto Networks (CVE record)

CISA KEV required action

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

CISA due date:

SourceCISA KEV

Last verified 1 Oct 2026 at 13:37 UTC

Known exploitation

Added to CISA KEV on 12 Apr 2024

Federal remediation due date: 19 Apr 2024

Known use in ransomware campaigns

The CISA required action is shown under Remediation.

100% probability of exploitation in the next 30 days (percentile 100%).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CERT-FR

No CERT-FR advisory or alert of the last two years references this CVE, for the vendors Patcharo covers.

Timeline

  1. Added to CISA KEV
  2. Published by the source
  3. CISA remediation due date
  4. Source record last modified
  5. EPSS score computed
  6. Last verified by Patcharo

Official sources

Vendor advisory

References

Palo Alto Networks · CISA Known Exploited Vulnerabilities · NVD · FIRST EPSS

How Patcharo reads this

Affected and fixed releases come from the vendor's structured statements and are matched against exact versions; CVSS from NVD, exploitation from CISA KEV and the vendor's own advisory, probability from FIRST EPSS. Missing data stays Unknown and never becomes Not affected.

Read the methodologyRead the guide: PAN-OS versions explained: release lines, maintenance releases and the -h1, -h2, -h3 suffixes

Related vulnerabilities

Other records affecting the same products, newest first.

  • CVE-2026-0301PAN-OS: Information Disclosure Vulnerability in URL FilteringHigh
  • CVE-2026-0280PAN-OS: IPv6 Firewall Policy BypassHigh
  • CVE-2026-0281PAN-OS: Information Disclosure Vulnerability in Management Web InterfaceHigh
  • CVE-2026-0283PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)High
  • CVE-2026-0284PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)Critical

All PAN-OS vulnerabilitiesAll Palo Alto Networks vulnerabilities