The Palo Alto firewall flaw CVE-2024-3400 is a critical command injection bug in the PAN-OS GlobalProtect feature. It lets an unauthenticated attacker run code with root privileges on the firewall. It scores 10.0 on CVSS and has been exploited in the wild. Fixes exist in PAN-OS 10.2.9-h1, 11.0.4-h1 and 11.1.2-h3.
What is the Palo Alto PAN-OS vulnerability?
Palo Alto Networks has recently issued urgent fixes to remedy a critical security vulnerability affecting PAN-OS software. This vulnerability tracked as CVE-2024-3400 with a severity score of 10.0 (CVSS), has been actively exploited in the wild.
Which PAN-OS versions are patched?
The vulnerability involves a case of command injection within the GlobalProtect feature, which could be exploited by unauthorized attackers to execute arbitrary code with root privileges on the firewall. The following versions have received patches to address this issue:
– PAN-OS 10.2.9-h1
– PAN-OS 11.0.4-h1
– PAN-OS 11.1.2-h3
Additional patches for other commonly deployed maintenance releases are expected to be rolled out in the coming days. Palo Alto Networks specified that this vulnerability affects only PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both).
Although Cloud NGFW firewalls remain unaffected by CVE-2024-3400, certain PAN-OS versions and feature configurations of firewall VMs deployed and managed by customers in the cloud are vulnerable to CVE-2024-3400.
Is CVE-2024-3400 being exploited?
CISA lists CVE-2024-3400 as exploited in the wild and added it to its Known Exploited Vulnerabilities Catalog on April 12, 2024. Neither the NVD record nor the CISA alert names the actor behind the attacks.
Because the flaw needs no login and gives root access, organizations that run a GlobalProtect gateway or portal on an affected version should apply the fixed releases and follow the vendor’s guidance.
See also our CVE-2024-3400 vulnerability page.