10.0
Critical
Exploited
· ransomware
CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Ransomware campaigns
Known to be used
Weakness
CWE-20, CWE-77
Description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PAN-OS 11.1 | 11.1.0 → < 11.1.2-h3 | 11.1.2-h3 |
| PAN-OS 11.0 | 11.0.0 → < 11.0.4-h1 | 11.0.4-h1 |
| PAN-OS 10.2 | 10.2.0 → < 10.2.9-h1 | 10.2.9-h1 |
| PAN-OS 10.1 | earliest → < 10.1.0 | 10.1.0 |
| PAN-OS 10.0 | earliest → < 10.0.0 | 10.0.0 |
| PAN-OS 9.1 | earliest → < 9.1.0 | 9.1.0 |
| PAN-OS 9.0 | earliest → < 9.0.0 | 9.0.0 |
| Cloud NGFW | Versions not published | |
| Prisma Access | Versions not published |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| pan-os 11.1 | 11.1.0 → < 11.1.2-h3 | 11.1.2-h3 |
References
- security.paloaltonetworks.com security.paloaltonetworks.com
- unit42.paloaltonetworks.com unit42.paloaltonetworks.com
- www.volexity.com www.volexity.com
- www.paloaltonetworks.com www.paloaltonetworks.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of PAN-OS
The 197 CVEs of PAN-OS →
CVE-2026-0316
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious…
1.1
Low
CVE-2026-0317
A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only…
1.2
Low
CVE-2026-0318
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software…
4.6
Medium
CVE-2026-0319
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables…
4.9
Medium