CVE-2024-9474: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CISA Known Exploited Vulnerabilities

Name

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Vendor

Palo Alto Networks

Product

PAN-OS

Added to the catalog

2024-11-18

Due date for US federal agencies

2024-12-09

Weaknesses

CWE-77

Catalog version

2026.10.30

Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://security.paloaltonetworks.com/CVE-2024-9474
• https://nvd.nist.gov/vuln/detail/CVE-2024-9474

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2024-11-18T16:15:29.780

Last modified

2026-08-04T05:16:32.247

Weaknesses

CWE-78

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.

References

• https://security.paloaltonetworks.com/CVE-2024-9474 (Vendor Advisory)
• https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ (Press/Media Coverage, Vendor Advisory)
• https://github.com/k4nfr3/CVE-2024-9474 (Exploit)
• https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ (Exploit, Third Party Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:15.686Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-9474

CVE record

Title (CNA)

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Assigner

palo_alto

State

PUBLISHED

Published

2024-11-18T15:48:23.405Z

Updated

2026-08-04T03:55:32.780Z

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.

References

• https://security.paloaltonetworks.com/CVE-2024-9474

Read on 2026-11-03T02:14:32.258Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9474.json

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/