CVE-2024-3400
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
|
| Impact | Maximum risk (CVSS 10.0, EPSS 94.3%). Palo Alto firewalls protect critical enterprise and government networks. Root compromise of the firewall gives attackers complete control over network traffic, credentials, and the ability to modify security policies to hide malicious activity. |
| Exploit ScenarioDerived | The UTA0218 threat actor exploited the PAN-OS zero-day to create a cron job file containing reverse shell commands. The cron executed the commands, providing root access. The attacker then exfiltrated running configurations (containing credentials), modified firewall rules, and established persistent access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection via arbitrary file creation (CVSS 10.0) allowing unauthenticated root-level RCE, triggering an emergency patching directive from CISA in April 2024.
Earlier versions of this analysis (1)
A critical command injection vulnerability in PAN-OS GlobalProtect allows unauthenticated attackers to execute arbitrary code with root privileges. Rated CVSS 10.0 and exploited as a zero-day, CISA issued an emergency directive requiring immediate action.
RemediationAI
Apply PAN-OS hotfixes immediately. Disable GlobalProtect portal/gateway if not critical. Check for IoCs including suspicious cron jobs and modified configurations. Rotate all credentials accessible from the firewall.
Affected ProductsAI
Palo Alto Networks PAN-OS with GlobalProtect enabled (specific versions)
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-20 vulnerability allows unauthenticated attackers to create arbitrary files on the firewall through the GlobalProtect portal/gateway. The file creation capability is leveraged for command injection, achieving root-level code execution on the PAN-OS device.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Executive ViewAI
CVE-2024-3400 presents critical security risk, a input validation vulnerability rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC