Palo Alto Networks · PAN-OS
CVE-2024-9474
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
What it is
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CISA: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Deadline for US federal agencies: December 9, 2024
More exploited flaws from Palo Alto Networks
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 14, 2026 | Code Injection | PAN-OS | High 8.6 | 1.7% |
| May 29, 2026 | Authentication Bypass | PAN-OS | High 7.8 | 95% |
| May 6, 2026 | Out-of-bounds Write | PAN-OS | Critical 9.3 | 42% |
| Feb 20, 2025 | File Read | PAN-OS | High 7.1 | 2.0% |
| Feb 18, 2025 | Authentication Bypass | PAN-OS | High 8.8 | 98% |
| Dec 30, 2024 | Malicious DNS Packet | PAN-OS | High 8.7 | 29% |
| Nov 18, 2024 | Management Interface Authentication Bypass | PAN-OS | Critical 9.3 | 99.8% |
| Apr 12, 2024 | Command Injection | PAN-OS | Critical 10.0 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.