Cyber Resilience

CVE-2024-3400

CriticalCISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linkedRCE

Published: 12 April 2024

Published
12 April 2024
Modified
04 November 2025
KEV Added
12 April 2024
Patch
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.9430 99.9th percentile
Risk Priority 97 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-3400 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Paloaltonetworks Pan-Os. Its CVSS base score is 10.0 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability CVE-2024-3400 is a command injection resulting from arbitrary file creation in the GlobalProtect feature of Palo Alto Networks PAN-OS software on specific versions and distinct feature configurations. Successful exploitation allows unauthenticated attackers to run arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not affected.

An unauthenticated remote attacker can exploit the flaw over the network without user interaction to achieve full root-level code execution on impacted firewalls, consistent with the CVSS 10.0 rating tied to CWE-20 and CWE-77.

Palo Alto Networks security advisories along with Unit 42 and Volexity analyses at the listed reference URLs describe mitigation guidance and patch availability for supported PAN-OS releases. The EPSS score reached a peak of 0.9648 with a current value of 0.9430, and Volexity reporting explicitly addresses observed zero-day exploitation in the wild.

EU & UK References

Vulnerability details

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root…

more

privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

CWE(s)
KEV Date Added
12 April 2024

Related Threats

CVEs Like This One

CVE-2025-0108Same product: Paloaltonetworks Pan-Osboth on KEV
CVE-2025-0111Same product: Paloaltonetworks Pan-Osboth on KEV
CVE-2025-0114Same product: Paloaltonetworks Pan-Os
CVE-2026-0257Same product: Paloaltonetworks Pan-Osboth on KEV
CVE-2026-0227Same product: Paloaltonetworks Pan-Os
CVE-2026-0300Same product: Paloaltonetworks Pan-Osboth on KEV
CVE-2025-0118Same product class: VPN / SSL gateway
CVE-2016-5195Same product: Paloaltonetworks Pan-Osboth on KEV
CVE-2026-3055Same product class: VPN / SSL gatewayboth on KEV
CVE-2024-55591Same product class: VPN / SSL gatewayboth on KEV

Affected Assets

paloaltonetworks
pan-os
10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly blocks the arbitrary file creation and subsequent command injection by validating all externally supplied input to the GlobalProtect interface before processing.

prevent

Requires prompt application of vendor patches that eliminate the unauthenticated code-execution flaw in the affected PAN-OS GlobalProtect code paths.

prevent

Enforces disabling or restricting the GlobalProtect feature when not required, thereby removing the attack surface that the CVE exploits.

References