{"id":"CVE-2024-3400","published":"2024-04-12T08:15:06Z","modified":"2026-06-17T07:44:11Z","title":"Palo Alto Networks PAN-OS Command Injection Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"description":{"text":"A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.\n\nCloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw, arising from arbitrary file creation, exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. An unauthenticated attacker with network access could exploit it, without user interaction, to execute arbitrary code with root privileges on the firewall.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:11Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":1.0,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-04-12","dueDate":"2024-04-19","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","notes":"https://security.paloaltonetworks.com/CVE-2024-3400 ;   https://nvd.nist.gov/vuln/detail/CVE-2024-3400","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-04-12","exploitedFirstSeen":"2024-04-12","ransomware":true,"evidence":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12"},{"url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","date":"2024-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-04-12"},{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12"},{"url":"https://twitter.com/vuldb/status/1779054980487434272","date":"2024-04-13"},{"url":"https://www.fortiguard.com/outbreak-alert/pan-os-globalprotect-attack","date":"2024-04-15"},{"url":"https://www.greynoise.io/blog/cve-2024-3400-command-injection-vulnerability-palo-alto-networks-pan-os","date":"2024-04-15"},{"url":"https://isc.sans.edu/diary/Palo+Alto+Networks+GlobalProtect+exploit+public+and+widely+exploited+CVE20243400/30844","date":"2024-04-16"},{"url":"https://twitter.com/HackingLZ/status/1780239802496864474","date":"2024-04-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-17&host_type=src&vulnerability=cve-2024-3400","date":"2024-04-17"}],"evidenceTotal":462,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","tags":["Vendor Advisory"]},{"url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/","tags":["Technical Description","Vendor Advisory"]},{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","tags":["Vendor Advisory"]},{"url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/","tags":["Technical Description","Vendor Advisory"]},{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated exploit of internet-facing GlobalProtect portal","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"may enable an unauthenticated attacker to execute arbitrary code","start":205,"end":269}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A command injection as a result of arbitrary file creation vulnerability","start":0,"end":72}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-a16527afe6604bcf05a1","title":"Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)","publisher":"volexity.com","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","mentions":[{"quote":"Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)","start":23,"end":132},{"quote":"Through this cooperative investigation, the Palo Alto Networks PSIRT team was able to confirm the vulnerability as an OS command injection issue and assigned it CVE-2024-3400.","start":1388,"end":1563},{"quote":"Palo Alto Networks has since issued an advisory for CVE-2024-3400 that includes information regarding a threat protection signature released to customers, as well as a timeline for a fix, which at the time of writing is expected April 14, 2024.","start":1664,"end":1908},{"quote":"UTA0218 attempted to download and execute this file via the CVE-2024-3400 but was unsuccessful.","start":6824,"end":6919}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2024-3400 - Palo Alto Networks PAN-OS GlobalProtect arbitrary file creation leading to OS command injection.","start":8322,"end":8434},{"quote":"CVE-2024-3400","start":84396,"end":84409}]},{"id":"SRC-6befe779eb6a63e5b15c","title":"RansomHub never sleeps episode 1","publisher":"group-ib.com","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/","date":null,"mentions":[{"quote":"Their intelligence revealed a critical vulnerability—CVE-2024-3400—impacting Palo Alto Networks firewall appliances running an outdated PAN-OS software.","start":11171,"end":11323}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-31989","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31989","exploited":true,"exploitedSince":"2024-04-12","provenance":"source"},"exploits":[{"id":51996,"url":"https://www.exploit-db.com/exploits/51996","title":"Palo Alto PAN-OS  < v11.1.2-h3  - Command Injection and Arbitrary File Creation","type":"remote","platform":"linux_x86-64","date":"2024-04-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2024-04-21"},"pocGithub":{"count":39,"skipped":6,"earliest":"2024-04-13","earliestUrl":"https://github.com/Yuvvi01/CVE-2024-3400","repos":[{"name":"h4x0r-dz/CVE-2024-3400","url":"https://github.com/h4x0r-dz/CVE-2024-3400","stars":162,"created":"2024-04-16"},{"name":"W01fh4cker/CVE-2024-3400-RCE-Scan","url":"https://github.com/W01fh4cker/CVE-2024-3400-RCE-Scan","stars":89,"created":"2024-04-16"},{"name":"0x0d3ad/CVE-2024-3400","url":"https://github.com/0x0d3ad/CVE-2024-3400","stars":71,"created":"2024-04-13"},{"name":"ihebski/CVE-2024-3400","url":"https://github.com/ihebski/CVE-2024-3400","stars":34,"created":"2024-04-16"},{"name":"Chocapikk/CVE-2024-3400","url":"https://github.com/Chocapikk/CVE-2024-3400","stars":15,"created":"2024-04-16"}]},"metasploit":[{"name":"Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution","module":"exploit/linux/http/panos_telemetry_cmd_exec","type":"exploit","disclosureDate":"2024-04-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_telemetry_cmd_exec.rb"}],"nuclei":[{"id":"CVE-2024-3400","name":"GlobalProtect - OS Command Injection","severity":"critical","path":"http/cves/2024/CVE-2024-3400.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml"}],"first":{"date":"2024-04-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_telemetry_cmd_exec.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection","id":"f130a5f1-73ba-42f0-bf1e-b66a8361cb8f","level":"high","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml","techniques":[]},{"title":"Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation","id":"bcd95697-e3e7-4c6f-8584-8e3503e6929f","level":"medium","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml","techniques":[]}]},"exploitRefs":["https://unit42.paloaltonetworks.com/cve-2024-3400/","https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-04-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3400","provenance":"source"},{"date":"2024-04-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-04-13, Exploit-DB 2024-04-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_telemetry_cmd_exec.rb","provenance":"source"},{"date":"2024-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://security.paloaltonetworks.com/CVE-2024-3400","provenance":"source"},{"date":"2024-04-12","kind":"report","label":"Named in volexity.com: Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (C…","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","provenance":"machine"},{"date":"2024-04-12","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-04-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31989","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":87.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 932 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 39 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-palo-alto-networks-pan-os-cwe-20"}}