PAN-OS CVE-2024-3400 and the management interface
Ten out of ten. In April 2024, Palo Alto Networks disclosed a flaw that let anyone on the Internet run code as root on its firewalls, without logging in. CISA added it to its catalog of exploited vulnerabilities the very same day.
Seven months later, the management interface had its turn.
The official record
CVE-2024-3400, in GlobalProtect, on PAN-OS 10.2, 11.0 and 11.1: code execution as root, no login, scored 10.0.
Then CVE-2024-0012, which grants administrator rights on the management web interface with no login, and CVE-2024-9474, which turns an administrator into root. Palo Alto names the two together.
All three are in CISA's catalog, all three used by ransomware.
How easy is it?
For the first flaw, the firewall only needs a GlobalProtect portal or gateway configured, and those face the Internet. For the second, the management interface has to be reachable.
No account. Low complexity. Palo Alto rates the first as automatable.
How it works, in principle
Requests reach the firewall's own services. The flaw runs the attacker's code on the firewall itself, as root.
From there, the device that was supposed to filter the traffic lets it through. The guard becomes the way in.
The impact
Root on the firewall. A configuration that can be read and changed.
Palo Alto also warned of public techniques that keep a foothold across resets and upgrades. And everything behind the firewall trusts it.
How to close it
Upgrade to the fixed hotfix for your release, and Palo Alto insists: upgrade even if you already applied a mitigation. Keep the management interface on trusted internal addresses only, never on the Internet.
As an interim measure for the GlobalProtect flaw, Threat Prevention signatures can block it. Disabling telemetry, an early suggestion, is no longer considered a fix.
What NacTrack shows
NacTrack reads each PAN-OS firewall's version and hotfix level, and matches them against the published advisories, with CISA's known exploited flag.
Read also
In October 2026, the PAN-OS management interface was targeted again, this time through a PHP flaw: PHP2Shell on PAN-OS.
Sources
Sources: CISA KEV, Palo Alto Networks advisories (CVE-2024-3400, 0012, 9474), NVD.
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.
Know where your network is exposed
NacTrack reads versions and configurations off your devices, and checks them against published advisories.