Article
KEV and ransomware: which entries are flagged
361 of 1739 CISA KEV entries (20.8 percent) are flagged as used in ransomware campaigns. Mail and file transfer servers lead at 38.7 percent…
Read more
Exploited vulnerability
PAN-OS GlobalProtect command injection (CVE-2024-3400)
CVE-2024-3400
CVE-2024-3400 is a flaw in the GlobalProtect feature of Palo Alto Networks PAN-OS firewalls.
- On CISA KEV
- CVE ID
- CVE-2024-3400
- CISA KEV
- Listed
- Affected product
- PAN-OS (GlobalProtect gateway and portal)
- Exploited
- Yes
- Published
- April 2024
In short
CVE-2024-3400 is a flaw in the GlobalProtect feature of Palo Alto Networks PAN-OS firewalls. The vendor says it can let an unauthenticated attacker run code with root privileges on the firewall. The vendor's own advisory lists it as discovered in production use, and CISA lists it as exploited.
- CVECVE-2024-3400
- ProductPalo Alto Networks PAN-OS (GlobalProtect gateway and portal)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listed
What it allows
An attacker on the network, with no login, can run commands as the root user on the firewall. Root is the highest level of control on the device. From there an attacker can read configuration data and use the firewall as a foothold into the internal network. The vendor rates it CRITICAL, with a CVSS score of 10.0.
Who is affected
The vendor says only PAN-OS 10.2, 11.0 and 11.1 firewalls configured with a GlobalProtect gateway or portal (or both) are exposed. PAN-OS 10.1, 9.1 and 9.0 are listed as not affected. Cloud NGFW, Panorama appliances and Prisma Access are not affected. Device telemetry does not need to be on for a firewall to be exposed. You can check for a gateway or portal in the firewall web interface under Network, then GlobalProtect.
Palo Alto Networks published its advisory on 12 April 2024 and states the flaw was discovered in production use. It later said it was aware of an increasing number of attacks, and that proof of concept code had been made public by third parties.
CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities catalog on 12 April 2024, with a due date of 19 April 2024 for federal agencies. The catalog marks known ransomware campaign use as Known.
The vendor also noted third party proof of concept work on persistence techniques that survive resets and upgrades. These work only on a device that is already compromised. It said it was not aware of malicious use of them at the time of its update.
What to do
-
Upgrade to a fixed PAN-OS release
The vendor strongly advises upgrading to a fixed version of PAN-OS right away, even if workarounds are in place. Fixed releases are listed per branch in the vendor advisory for 10.2, 11.0 and 11.1.
-
Use Threat Prevention if you cannot upgrade yet
Customers with a Threat Prevention subscription can block the attack with the Threat IDs in the advisory. Vulnerability protection must be applied to the GlobalProtect interface for this to work. Disabling device telemetry is no longer an effective mitigation.
-
Check logs for attempted exploitation
The vendor gives a command to search the GlobalProtect log. If the value in the session field is a file path or shell commands instead of a GUID (a random identifier), treat it as an attempt and investigate.
-
Collect evidence before you reboot
Take a tech support file before rebooting into a fixed version, so logs from the old installation are kept. If you see signs of exploitation, follow the vendor's remediation steps.
-
Consider an enhanced factory reset
The vendor recommends this for customers who had not applied fixes or signatures by 25 April 2024, and for anyone worried about lasting access. It can be scheduled through vendor support.
Questions
What is CVE-2024-3400?
It is a command injection flaw in the GlobalProtect feature of Palo Alto Networks PAN-OS. An attacker on the network with no login can run commands as root on the firewall. The vendor rates it critical, CVSS 10.0.
Which PAN-OS versions are affected?
Only PAN-OS 10.2, 11.0 and 11.1 firewalls configured with a GlobalProtect gateway or portal. PAN-OS 10.1, 9.1 and 9.0, Cloud NGFW, Panorama and Prisma Access are not affected.
How do I check if my firewall was attacked?
Search the GlobalProtect log with the command in the vendor advisory. If the session field holds a file path or shell commands instead of a GUID, treat it as an attempt. Take a tech support file before rebooting.
Is CVE-2024-3400 exploited in the wild?
Yes. The vendor states it was discovered in production use and later saw increasing attacks. CISA added it to its Known Exploited Vulnerabilities catalog on 12 April 2024.
In our research
- KEV and ransomware: which entries are flagged October 2026
- Salt Typhoon: what telecom customers should do October 2026
- Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
- Palo Alto Networks Releases Urgent Fixes for Critical Security Flaw in PAN-OS Software April 2024
Sources
- CVE-2024-3400 security advisory Palo Alto Networks
- CVE-2024-3400 record NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog (JSON feed) CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.