Vulnerabilities/Palo Alto Networks/CVE-2024-3400

CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownPatch available

CVSS 3.1 · NVD10.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 12 Apr 2024

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

Recommended action

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

CISA due date 19 Apr 2024 · CWE-20, CWE-77

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
PAN-OS9.0.09.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
PAN-OS9.1.09.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
PAN-OS10.0.09.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
PAN-OS10.1.09.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
PAN-OS10.2.0 to before 10.2.9-h1; unaffected from 10.2.9-h19.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
Show 7 more rows
PAN-OS11.0.0 to before 11.0.4-h1; unaffected from 11.0.4-h19.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
PAN-OS11.1.0 to before 11.1.2-h3; unaffected from 11.1.2-h39.0.0, 9.1.0, 10.0.0, 10.1.0, 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
Cloud NGFWAllAll
Prisma AccessAllAll
pan-os10.2.0 to before 10.2.9-h1Unknown
pan-os11.0.0 to before 11.0.4-h1Unknown
pan-os11.1.0 to before 11.1.2-h3Unknown

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 12 Apr 2024 · Added to CISA KEV
  • 19 Apr 2024 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.