CVE-2024-9474

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2024
Last modified
Aug 4, 2026
Added to CISA KEV
Nov 18, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-94757.2The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parCVE-2024-94765.1A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other oCVE-2024-94776.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allowsCVE-2024-947810.0Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue aCVE-2024-947910.0Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue aCVE-2024-94815.5An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eCVE-2024-94825.5An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed MCVE-2024-94835.5A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS CVE-2024-94845.5An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformCVE-2024-94869.8A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image bCVE-2024-94879.1An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authenticCVE-2024-94889.8The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is du