CVE-2024-3400

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Critical 10.0
Exploited: added to CISA KEV 12 Apr 2024
Used in ransomware campaigns

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Key facts

Published: 12 Apr 2024
Last changed: 21 Oct 2025
Assigned by: palo_alto
KEV added: 12 Apr 2024
KEV fix due: 19 Apr 2024
Used in ransomware: Yes, according to CISA
EPSS: 99.999% likely to be exploited in the next 30 days, higher than 100% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

10.0CVSS 3.1, Criticalfrom the CNA (palo_alto)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What to do

We strongly advise customers to immediately upgrade to a fixed version of PAN-OS to protect their devices even when workarounds and mitigations have been applied. This issue is fixed in PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. Customers who upgrade to these versions will be fully protected.CNA solution statement
Recommended Mitigation: Customers with a Threat Prevention subscription can block attacks for this vulnerability using Threat IDs 95187, 95189, and 95191 (available in Applications and Threats content version 8836-8695 and later). Please monitor this advisory and new Threat Prevention content updates for additional Threat Prevention IDs around CVE-2024-3400. To apply the Threat IDs, customers must ensure that vulnerability protection has been applied to their GlobalProtect interface to prevent exploitation of this issue on their device. Please see https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184 for more information.CNA workaround statement
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-248 Command Injection (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	Default status: unaffected 9.0.0 (unaffected) 9.1.0 (unaffected) 10.0.0 (unaffected) 10.1.0 (unaffected) 10.2.0 up to but excluding 10.2.9-h1 (affected); at 10.2.9-h1 unaffected 11.0.0 up to but excluding 11.0.4-h1 (affected); at 11.0.4-h1 unaffected 11.1.0 up to but excluding 11.1.2-h3 (affected); at 11.1.2-h3 unaffected
Palo Alto Networks	Cloud NGFW	Default status: unaffected All (unaffected)
Palo Alto Networks	Prisma Access	Default status: unaffected All (unaffected)