CVE-2024-3400: PAN-OS GlobalProtect command injection

CVE-2024-3400 is a critical (CVSS 10.0), actively exploited command-injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS that lets an unauthenticated attacker run arbitrary code as root.

CVE-2024-3400 affects the GlobalProtect gateway or portal feature of Palo Alto Networks PAN-OS. An unauthenticated attacker can send a crafted request that creates an arbitrary file, which can then be used to execute commands with root privileges on the firewall (NVD).

NVD scores the flaw CVSS v3.1 10.0 (critical) — network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (NVD).

CISA added CVE-2024-3400 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-04-12, the same day it was published, and records known use in ransomware campaigns (CISA KEV).

Palo Alto Networks' own advisory lists PAN-OS 10.2 (10.2.0 through 10.2.9, fixed in 10.2.9-h1), 11.0 (11.0.0 through 11.0.4, fixed in 11.0.4-h1) and 11.1 (11.1.0 through 11.1.2, fixed in 11.1.2-h3) as affected when the GlobalProtect gateway or portal is enabled; Cloud NGFW, Panorama appliances and Prisma Access are not affected (Palo Alto Networks Security Advisory).

As of 2026-10-19, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9999, 100th percentile), consistent with a vulnerability that remains under mass scanning more than two years after disclosure (FIRST EPSS).

Devices on an affected PAN-OS branch should be updated to a fixed hotfix release; where patching is not immediately possible, the vendor advisory above describes interim mitigations such as disabling GlobalProtect or enabling the relevant Threat Prevention signatures.

• Unauthenticated command injection in PAN-OS GlobalProtect allows arbitrary file creation and root code execution. — NVD
• NVD CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-04-12 with known ransomware campaign use. — CISA KEV
• Affected: PAN-OS 10.2.0-10.2.9, 11.0.0-11.0.4, 11.1.0-11.1.2 with GlobalProtect enabled; Cloud NGFW, Panorama and Prisma Access are not affected. — Palo Alto Networks Security Advisory
• EPSS score is 0.9999 (100th percentile) as of 2026-10-19. — FIRST EPSS