Summary
generated automatically from NVD dataCVE-2024-3400 is a command injection flaw, arising from arbitrary file creation, in the GlobalProtect feature of Palo Alto Networks PAN-OS, affecting specific versions and feature configurations. An unauthenticated attacker could execute arbitrary code with root privileges on the firewall. It is rated CRITICAL with a CVSS v3.1 score of 10.0, and CISA's KEV catalog lists it as exploited, including in ransomware campaigns. Cloud NGFW, Panorama appliances and Prisma Access are not impacted.
NVD description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2024-04-12. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2024-04-19
Used in known ransomware campaigns.
EPSS · FIRST.org
100.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 12 avr. 2024
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- psirt@paloaltonetworks.com
Affected products
Weaknesses (CWE)
References (9)
- https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
- https://unit42.paloaltonetworks.com/cve-2024-3400/ExploitVendor Advisory
- https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical DescriptionVendor Advisory
- https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
- https://unit42.paloaltonetworks.com/cve-2024-3400/ExploitVendor Advisory
- https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical DescriptionVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-20
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.