{"schema":"threatline.record/2","record":{"id":"CVE-2024-3400","aliases":[],"summary":"Palo Alto Networks PAN-OS Command Injection Vulnerability","details":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.","categories":["Network & edge"],"product":"PAN-OS","vendor":"Palo Alto Networks","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"PAN-OS","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"9.0.0"},{"status":"unaffected","version":"9.1.0"},{"status":"unaffected","version":"10.0.0"},{"status":"unaffected","version":"10.1.0"},{"changes":[{"at":"10.2.9-h1","status":"unaffected"}],"lessThan":"10.2.9-h1","status":"affected","version":"10.2.0","versionType":"custom"},{"changes":[{"at":"11.0.4-h1","status":"unaffected"}],"lessThan":"11.0.4-h1","status":"affected","version":"11.0.0","versionType":"custom"},{"changes":[{"at":"11.1.2-h3","status":"unaffected"}],"lessThan":"11.1.2-h3","status":"affected","version":"11.1.0","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Cloud NGFW","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Prisma Access","vendor":"Palo Alto Networks","versions":[{"status":"unaffected","version":"All"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PAN-OS","ecosystem":null},"version":"10.2.9-h1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PAN-OS","ecosystem":null},"version":"11.0.4-h1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","source_modified_at":"2025-10-21T23:05:21.315Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PAN-OS","ecosystem":null},"version":"11.1.2-h3","basis":"first unaffected version stated in the CVE record"}],"cvss":10,"severity":"Critical","kev":{"listed":true,"date_added":"2024-04-12","due_date":"2024-04-19","required_action":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","ransomware_campaign_use":"Known"},"epss":{"probability":0.99999,"percentile":1,"score_date":"2026-10-23"},"published_at":"2024-04-12T07:20:00.707Z","modified_at":"2025-10-21T23:05:21.315Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-3400","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:05:21.315Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_telemetry_cmd_exec.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2024-04-12"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/51996","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2024-04-21"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3400","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://security.paloaltonetworks.com/CVE-2024-3400","tags":["vendor-advisory","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3400","source":"CISA KEV"},{"source":"CVE List","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","tags":["technical-description","x_transferred"]},{"source":"CVE List","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","tags":["technical-description","x_transferred"]},{"source":"CVE List","url":"https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/","tags":["technical-description","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2024-04-17T04:00:13.543064Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_telemetry_cmd_exec.rb","date":"2024-04-12","added":"2026-06-03","check":true},{"source":"Exploit-DB","kind":"Remote exploit","name":"Palo Alto PAN-OS  < v11.1.2-h3  - Command Injection and Arbitrary File Creation","url":"https://www.exploit-db.com/exploits/51996","date":"2024-04-21","added":"2024-04-21","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"GlobalProtect - OS Command Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3400.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:05:21.315Z","content_hash":"47c347c24bde6ddf2d782045d39e8e240c1bdf43dca07baa0a3df91784f67e1a"}}