CVE-2024-3400

CRITICAL 10.0

⚠️ CISA KEV

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

CWE	CWE-77 CWE-20
Vendor	palo alto networks
Product	pan-os
Published	Apr 12, 2024
Last Updated	Oct 21, 2025

⚠️ Actively Exploited — Act Now

Get instant alerts for palo alto networks pan-os

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2024-3400.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Palo Alto Networks / PAN-OS

10.2.0 < 10.2.9-h1 11.0.0 < 11.0.4-h1 11.1.0 < 11.1.2-h3

Palo Alto Networks / Cloud NGFW

All versions affected

Palo Alto Networks / Prisma Access

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.paloaltonetworks.com: https://security.paloaltonetworks.com/CVE-2024-3400 unit42.paloaltonetworks.com: https://unit42.paloaltonetworks.com/cve-2024-3400/ volexity.com: https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ paloaltonetworks.com: https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400

Credits

Palo Alto Networks thanks Volexity for detecting and identifying this issue. Capability Development Group at Bishop Fox for helping us verify the fixes and improve threat prevention signatures.