CVE-2024-9474

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	—
Palo Alto Networks	PAN-OS	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6
Palo Alto Networks	Prisma Access	—
paloaltonetworks	pan-os	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6
paloaltonetworks	pan-os	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6
paloaltonetworks	pan-os	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6
paloaltonetworks	pan-os	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6
paloaltonetworks	pan-os	>= 11.2.0, < 11.2.4-h1; >= 11.1.0, < 11.1.5-h1; >= 11.0.0, < 11.0.6-h1; >= 10.2.0, < 10.2.12-h2; >= 10.1.0, < 10.1.14-h6

References

https://security.paloaltonetworks.com/CVE-2024-9474Vendor Advisory
https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/Press/Media Coverage, Vendor Advisory
https://github.com/k4nfr3/CVE-2024-9474Exploit
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474US Government Resource

Timeline

Published: Nov 18, 2024
Last modified: Aug 4, 2026
Added to CISA KEV: Nov 18, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-94757.2The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by par CVE-2024-94765.1A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other o CVE-2024-94776.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows CVE-2024-947810.0Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a CVE-2024-947910.0Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a CVE-2024-94815.5An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed e CVE-2024-94825.5An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed M CVE-2024-94835.5A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS CVE-2024-94845.5An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malform CVE-2024-94869.8A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image b CVE-2024-94879.1An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentic CVE-2024-94889.8The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is du