Palo Alto Networks · PAN-OS
CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
What it is
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CISA: Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
What to do
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Deadline for US federal agencies: April 19, 2024
More exploited flaws from Palo Alto Networks
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 14, 2026 | Code Injection | PAN-OS | High 8.6 | 1.7% |
| May 29, 2026 | Authentication Bypass | PAN-OS | High 7.8 | 95% |
| May 6, 2026 | Out-of-bounds Write | PAN-OS | Critical 9.3 | 42% |
| Feb 20, 2025 | File Read | PAN-OS | High 7.1 | 2.0% |
| Feb 18, 2025 | Authentication Bypass | PAN-OS | High 8.8 | 98% |
| Dec 30, 2024 | Malicious DNS Packet | PAN-OS | High 8.7 | 29% |
| Nov 18, 2024 | Management Interface Authentication Bypass | PAN-OS | Critical 9.3 | 99.8% |
| Nov 18, 2024 | Management Interface OS Command Injection | PAN-OS | Medium 6.9 | 94% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.