PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect (CVE-2024-3400)

What is affected, what to do

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Palo Alto Networks PAN-OS to version 10.2.9-h1, Palo Alto Networks PAN-OS to version 11.0.4-h1, Palo Alto Networks PAN-OS to version 11.1.2-h3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS lt 10.2.0..10.2.9-h1
• Palo Alto Networks PAN-OS lt 11.0.0..11.0.4-h1
• Palo Alto Networks PAN-OS lt 11.1.0..11.1.2-h3

Fixed in

• Palo Alto Networks PAN-OS 10.2.9-h1
• Palo Alto Networks PAN-OS 11.0.4-h1
• Palo Alto Networks PAN-OS 11.1.2-h3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Scope exposure: Inventory every PAN-OS firewall on the 10.2, 11.0 and 11.1 trains that has a GlobalProtect gateway or portal configured (Network > GlobalProtect > Gateways/Portals). Cloud NGFW, Panorama and Prisma Access are out of scope per the advisory. Start with internet-facing GlobalProtect.
   • Apply the hotfix: Upgrade to at least PAN-OS 10.2.9-h1, 11.0.4-h1 or 11.1.2-h3. Older maintenance releases have their own hotfixes – look up the exact version in the vendor advisory. Upgrade HA pairs sequentially and confirm the running version after the reboot.
   • Check for compromise before patching: Pull a Tech Support File (TSF) before upgrade-driven log rotation destroys evidence. Then run grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*. A hit containing a path fragment (../) in the session value strongly indicates an exploitation attempt.
   • If compromise is suspected: Treat the appliance as untrusted, because a hotfix does not remove persistence. Factory-reset or reimage it following the vendor's remediation guidance, then restore configuration from a verified backup.
   • Rotate secrets (mandatory on suspicion, risk-based otherwise): local admin accounts, the firewall's LDAP/RADIUS service accounts, IPsec PSKs, API keys, GlobalProtect certificates and private keys, and the master key.
   • Regulatory clock: If a perimeter device compromise is confirmed, plan for the NIS2 24-hour early warning to your national CSIRT/competent authority.
2. 02

   Runbook step 2

   Mitigation layers

   • IPS (Threat Prevention): If you hold a Threat Prevention licence, set the vendor signatures for CVE-2024-3400 (Threat IDs 95187, 95189, 95191 – confirm currency in the advisory) to "reset-both". Make sure the Vulnerability Protection profile is attached to the rule matching GlobalProtect traffic on the GlobalProtect interface, and keep content updates current.
   • Important caveat: Disabling device telemetry, which was the early workaround, is not considered effective mitigation. Never rely on it in place of the hotfix or the IPS signature.
   • Network segmentation: Restrict the management interface to a dedicated admin VLAN or jump host. Egress-filter the firewall's own management and dataplane IPs at an upstream device so they can only reach required destinations (updates, Panorama, log collectors).
   • Attack-surface reduction: If you can neither patch nor deploy the signature right away, temporarily disable GlobalProtect on exposed interfaces or restrict it with geo/IP allowlists. Weigh this against the remote-access business impact.
   • IAM / least privilege: Limit the firewall's LDAP bind accounts to read-only, restrict their AD logon to the firewall IPs, and enforce MFA on all VPN access.
3. 03

   Runbook step 3

   Detection rules

   • PAN-OS threat log (SIEM): Alert on the CVE signatures. KQL: CommonSecurityLog | where DeviceVendor == "Palo Alto Networks" and Activity == "THREAT" and DeviceEventClassID in ("95187","95189","95191").
   • gpsvc.log / TSF review: Look for SESSID cookie values containing path traversal (../) or shell metacharacters (`, $(, ${IFS}). Also check for unexpected files under /var/appweb/sslvpndocs/global-protect/ and /opt/panlogs/tmp/device_telemetry/.
   • Network telemetry (Zeek/Suricata/NetFlow): Watch for outbound HTTP(S) connections originating from the firewall itself (management or dataplane IP) to destinations outside Palo Alto update infrastructure, especially with curl/wget-style user agents. Small script downloads shortly after inbound GlobalProtect traffic are a further red flag.
   • Config and data exfiltration: Flag unusual exports of running-config.xml or large outbound transfers from the firewall IP. Correlate them with config-log entries that have no matching admin login.
   • Downstream movement (Windows): Monitor Event IDs 4624 (logon type 3) and 4769 from the firewall's LDAP service account against atypical hosts. Also watch for new VPN sessions from unknown source IPs followed by RDP/SMB from the GlobalProtect address pool (Sysmon EID 3 on targets).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), NCSC NZ (CC BY 4.0), pwn.watch

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

  Class

  The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

  Entry at MITRE CWE-77

• CWE-20Improper Input Validation

  Class

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  Entry at MITRE CWE-20

References & sources

• security.paloaltonetworks.comCVE-2024-3400 PAN-OS: arbitrary file creation leads to OS command injection in GlobalProtectVendor advisory, Vendor advisory, pwn-watch
• unit42.paloaltonetworks.comThreat brief: Operation MidnightEclipse, post-exploitation activity related to CVE-2024-3400Technical description, Exploit, Vendor advisory, pwn-watch
• volexity.comZero-day exploitation of unauthenticated RCE in GlobalProtect (CVE-2024-3400)Technical description, Exploit, Third-party advisory, pwn-watch
• paloaltonetworks.comblog/2024/04/more-on-the-pan-os-cveTechnical description, Technical description, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400government-resource, US government resource
• cert.atCERT.at: Update#3: Kritische Sicherheitslücke in Palo Alto PAN-OS (Global Protect) aktiv ausgenützt - Patches verfügbarcert-at
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2024-ALE-006 – [MàJ] Vulnérabilité dans Palo Alto Networks GlobalProtect (clôturée 2024-07-01)cert-fr
• pwn.watchpwn.watch: Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)pwn-watch
• NVD (NIST)NVD: CVE-2024-3400pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Linked advisories

• SSA-750274 V1.0: Impact of CVE-2024-3400 on RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFWSiemens ProductCERT