PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) (CVE-2024-0012)

What is affected, what to do

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Palo Alto Networks PAN-OS to version 11.2.4-h1, Palo Alto Networks PAN-OS to version 11.1.5-h1, Palo Alto Networks PAN-OS to version 11.0.6-h1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS lt 11.2.0..11.2.4-h1
• Palo Alto Networks PAN-OS lt 11.1.0..11.1.5-h1
• Palo Alto Networks PAN-OS lt 11.0.0..11.0.6-h1
• Palo Alto Networks PAN-OS lt 10.2.0..10.2.12-h2

Fixed in

• Palo Alto Networks PAN-OS 11.2.4-h1
• Palo Alto Networks PAN-OS 11.1.5-h1
• Palo Alto Networks PAN-OS 11.0.6-h1
• Palo Alto Networks PAN-OS 10.2.12-h2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Check management-interface exposure: Determine whether the web management UI (HTTPS) is reachable from the internet or from untrusted segments. This covers the dedicated MGT port and any data interface with an Interface Management Profile allowing HTTPS/HTTP, such as GlobalProtect portal or gateway interfaces. Exposed devices go to the top of the queue.
   • Patch: Upgrade PAN-OS to a fixed release – 10.2.12-h2, 11.0.6-h1, 11.1.5-h1 or 11.2.4-h1 (or later in the same train). Check the vendor advisory for hotfixes on other maintenance releases. The update also fixes the chained privilege escalation CVE-2024-9474, so treat both CVEs together.
   • Lock down access now if you cannot patch within hours: Under Device > Setup > Interfaces > Management > Permitted IP Addresses, allow only dedicated admin jump hosts. Strip HTTPS/HTTP from every Interface Management Profile bound to externally reachable interfaces.
   • Assess compromise before patching: Preserve the running config and config audit trail, and generate a Tech Support File. Patching does not remove dropped webshells or rogue admin accounts. If anything looks off, engage Palo Alto TAC about an enhanced factory reset.
   • Rotate secrets if compromise is suspected: Replace local admin passwords, API keys and config-stored secrets (LDAP/RADIUS bind accounts, IPsec PSKs, certificate private keys, GlobalProtect certificates). An attacker with admin rights can export the full configuration.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Make the management plane reachable only from an isolated out-of-band management VLAN. Access should go through PAM-brokered jump hosts with MFA, and the MGT port should never be reachable from the internet. Use upstream ACLs to allowlist TCP/443 and TCP/22 to the management IP.
   • IPS/Threat Prevention: Enable the Palo Alto Threat Prevention signatures for CVE-2024-0012 and CVE-2024-9474 (look up the threat IDs in the vendor advisory). They only help when management is exposed via a data interface with a security profile set to "block"; they do not cover the MGT port.
   • Upstream IDS rule (Suricata/Snort): Alert on or drop HTTP requests to the firewall management IP that carry the header X-PAN-AUTHCHECK: off. Do the same for /php/ paths with an appended .js.php suffix, e.g. ztp_gate.php/.js.php. This requires TLS inspection or reverse-proxy logging.
   • IAM/least privilege: Trim admin role profiles to the minimum, delete unused local accounts and enforce SAML/RADIUS admin authentication with MFA. This does not block the bypass itself, but it makes persistence harder.
   • Management-plane egress control: Restrict outbound traffic from the management IP to required destinations only (update servers, NTP, DNS, syslog, Panorama). This blocks reverse shells and tool downloads.
3. 03

   Runbook step 3

   Detection rules

   • Web/proxy logs: Requests to the management UI that carry X-PAN-AUTHCHECK: off or match the URI pattern \/php\/.*\.php\/.*\.js\.php are a high-fidelity signal. SPL: index=proxy dest_ip=<mgmt_ip> (uri="*.js.php" OR http_header="*X-PAN-AUTHCHECK*").
   • PAN-OS config and system logs (syslog → SIEM): Investigate new admin accounts and config changes or commits with no matching change ticket or from unknown source IPs. Usernames containing shell metacharacters ($(, backticks, ;) point to CVE-2024-9474 exploitation. SPL: index=pan sourcetype=pan:config (cmd=add OR cmd=set) path="*mgt-config users*" | stats count by src, admin, path.
   • Admin authentication: Alert on admin actions with no preceding auth-success system-log entry and on admin logins from non-approved networks. Sigma shape: logsource: paloalto/system; selection: eventid: auth-success; filter: src_ip|cidr not in admin_jumphosts.
   • Network telemetry (Zeek/NetFlow): Treat outbound connections from the management IP to unknown destinations as suspicious, especially HTTP(S) downloads and long-lived TCP sessions that may be reverse shells. Zeek: conn.log where id.orig_h == <mgmt_ip> and id.resp_h is not on the allowlist.
   • Filesystem indicators (TSF/TAC): Unexpected PHP files in the management web root (e.g. under /var/appweb/htdocs/unauth/) suggest a webshell. Analyse them via the TSF with TAC and against the vendor-published IoCs.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE), pwn.watch

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• security.paloaltonetworks.comCVE-2024-0012 PAN-OS: authentication bypass in the management web interfaceVendor advisory, pwn-watch
• labs.watchtowr.compots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-…
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012government-resource
• unit42.paloaltonetworks.comcve-2024-0012-cve-2024-9474
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2024-ALE-015 – [MàJ] Multiples vulnérabilités sur l'interface d'administration des équipements Palo Alto Networks (clôturée 2025-01-27)cert-fr
• pwn.watchpwn.watch: Palo Alto PAN-OS management interface auth bypass + privilege escalationpwn-watch
• security.paloaltonetworks.comCVE-2024-9474 PAN-OS: privilege escalation in the management web interfacepwn-watch
• NVD (NIST)NVD: CVE-2024-0012pwn-watch
• NVD (NIST)NVD: CVE-2024-9474pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch