ACTIVELY EXPLOITED
CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability
| Vendor | Palo Alto Networks |
|---|---|
| Product | PAN-OS |
| Actively exploited | Yes |
| Added to CISA KEV | 12 Apr 2024 |
| CISA federal deadline | 19 Apr 2024 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-20, CWE-77 |
Required action (CISA's text)
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
Description (NVD)
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
SOURCES
Other Palo Alto Networks flaws
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.