CVE-2024-0012: PAN-OS Management Interface Bypass

CVE-2024-0012 is an authentication bypass in the PAN-OS management web interface that lets an unauthenticated, network-based attacker gain PAN-OS administrator privileges when that interface is reachable from the internet or an untrusted network, and it was exploited at scale — including in ransomware intrusions — often chained with CVE-2024-9474 for full device takeover.

CVE-2024-0012 is an authentication bypass (CWE-306) in the PAN-OS management web interface. An unauthenticated attacker with network access to that interface can gain PAN-OS administrator privileges, letting them tamper with the configuration or chain the access into other authenticated privilege-escalation flaws such as CVE-2024-9474. NVD notes the issue applies only to PAN-OS 10.2, 11.0, 11.1 and 11.2, and that Cloud NGFW and Prisma Access are not impacted (NVD).

Scoring for this CVE differs by standard. NVD's own analysis gives it CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Palo Alto's own advisory instead scores it under the newer CVSS v4.0 standard at 9.3 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:H/U:Red — a CNA-reported figure using a different CVSS version, not an NVD-confirmed v3.1 score (NVD; Palo Alto Networks Security Advisory CVE-2024-0012).

Palo Alto's advisory lists the fixed releases as PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1 and 11.2.4-h1 (and later), states the flaw requires the management web interface to be exposed to the internet or an untrusted network (directly, or via a dataplane interface with a management profile configured), and says Palo Alto "is aware of an increasing number of attacks that leverage the exploitation of this vulnerability," with proof-of-concept code publicly disclosed by third parties. Recommended mitigations are restricting management-interface access to trusted internal IP addresses, using a jump box as the sole access point, and applying Threat Prevention signatures (Threat IDs 95746, 95747, 95752, 95753, 95759, 95763) where that subscription is available (Palo Alto Networks Security Advisory CVE-2024-0012).

CISA added CVE-2024-0012 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-11-18, with a required-action due date of 2024-12-09, and the catalog records known use in ransomware campaigns. CISA's required action additionally specifies that the management interface for affected devices should not be exposed to untrusted networks, including the internet (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.9986 (99.961th percentile) — near the top of the EPSS distribution, consistent with a pre-authentication, internet-facing firewall management flaw that was mass-exploited shortly after disclosure (FIRST EPSS).

Any PAN-OS device on an affected version with the management interface reachable from the internet or an untrusted network should be patched immediately, have management access restricted to trusted internal addresses, and be reviewed for signs of prior compromise given the documented ransomware use.

• Authentication bypass in the PAN-OS management web interface lets an unauthenticated, network-based attacker gain administrator privileges; affects PAN-OS 10.2, 11.0, 11.1, 11.2 (not Cloud NGFW or Prisma Access). — NVD
• NVD CVSS v3.1 base score is 9.8 (critical); Palo Alto's own advisory scores it 9.3 (critical) under CVSS v4.0 — a CNA-reported figure using a different CVSS version, not an NVD-confirmed v3.1 score. — NVD
• Fixed in PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1 and later; requires the management interface exposed to the internet or an untrusted network; Palo Alto observed an increasing number of attacks and public proof-of-concept code; mitigations are restricting management access to trusted IPs, a jump box, and specific Threat Prevention signatures. — Palo Alto Networks Security Advisory CVE-2024-0012
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-11-18, due date 2024-12-09, with known ransomware campaign use; required action includes not exposing the management interface to untrusted networks. — CISA KEV
• EPSS score is 0.9986 (99.961th percentile) as of 2026-10-20. — FIRST EPSS