CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability

CISA Known Exploited Vulnerabilities

Name

Palo Alto Networks PAN-OS Command Injection Vulnerability

Vendor

Palo Alto Networks

Product

PAN-OS

Added to the catalog

2024-04-12

Due date for US federal agencies

2024-04-19

Weaknesses

CWE-20, CWE-77

Catalog version

2026.10.30

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

Required action (CISA)

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://security.paloaltonetworks.com/CVE-2024-3400
• https://nvd.nist.gov/vuln/detail/CVE-2024-3400

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2024-04-12T08:15:06.230

Last modified

2026-06-17T07:44:11.533

Weaknesses

CWE-20, CWE-77

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

References

• https://security.paloaltonetworks.com/CVE-2024-3400 (Vendor Advisory)
• https://unit42.paloaltonetworks.com/cve-2024-3400/ (Exploit, Vendor Advisory)
• https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ (Technical Description, Vendor Advisory)
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ (Exploit, Third Party Advisory)
• https://security.paloaltonetworks.com/CVE-2024-3400 (Vendor Advisory)
• https://unit42.paloaltonetworks.com/cve-2024-3400/ (Exploit, Vendor Advisory)
• https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ (Technical Description, Vendor Advisory)
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ (Exploit, Third Party Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:15.686Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-3400

CVE record

Title (CNA)

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Assigner

palo_alto

State

PUBLISHED

Published

2024-04-12T07:20:00.707Z

Updated

2025-10-21T23:05:21.315Z

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-20 Improper Input Validation

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

References

• https://security.paloaltonetworks.com/CVE-2024-3400
• https://unit42.paloaltonetworks.com/cve-2024-3400/
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
• https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/

Read on 2026-11-03T02:06:28.152Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3400.json

Detection rules (SigmaHQ)

SigmaHQ rules whose own tags name this CVE. Each rule page shows the rule as its author published it.

• Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation (status test, level medium)
• Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection (status test, level high)

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/