CVE-2024-3400

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-77

Affected software

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	>= 10.2.0, < 10.2.9-h1; >= 11.0.0, < 11.0.4-h1; >= 11.1.0, < 11.1.2-h3
Palo Alto Networks	Cloud NGFW	—
Palo Alto Networks	Prisma Access	—
paloaltonetworks	pan-os	>= 10.2.0, < 10.2.9-h1
paloaltonetworks	pan-os	>= 11.0.0, < 11.0.4-h1
paloaltonetworks	pan-os	>= 11.1.0, < 11.1.2-h3

References

https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
https://unit42.paloaltonetworks.com/cve-2024-3400/Exploit, Vendor Advisory
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical Description, Vendor Advisory
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/Exploit, Third Party Advisory
https://security.paloaltonetworks.com/CVE-2024-3400Vendor Advisory
https://unit42.paloaltonetworks.com/cve-2024-3400/Exploit, Vendor Advisory
https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/Technical Description, Vendor Advisory
https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400US Government Resource

Timeline

Published: Apr 12, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 12, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-340004.3ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.CVE-2024-340018.4Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.CVE-2024-340026.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340035.9In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340046.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340056.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to resto CVE-2024-340064.3The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead o CVE-2024-340078.8The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.CVE-2024-340088.8Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.CVE-2024-340097.5Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages w CVE-2024-340108.2Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent CVE-2024-340116.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo