CVE-2024-3400 is a critical (CVSS 10.0), actively exploited command-injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS that lets an unauthenticated attacker create an arbitrary file and run commands as root; CISA added it to the Known Exploited Vulnerabilities catalog the same day it was published, citing known use in ransomware campaigns, and fixed hotfixes are available for the affected PAN-OS 10.2, 11.0 and 11.1 branches.
Vulnerability summary
CVSS base score
10
Critical severity
EPSS score (FIRST)
100.0%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2024-3400 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Palo Alto Networks PAN-OS 10.2 (GlobalProtect gateway/portal enabled) | cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:* | 10.2.0 through 10.2.9 (fixed in 10.2.9-h1) |
| Palo Alto Networks PAN-OS 11.0 (GlobalProtect gateway/portal enabled) | cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:* | 11.0.0 through 11.0.4 (fixed in 11.0.4-h1) |
| Palo Alto Networks PAN-OS 11.1 (GlobalProtect gateway/portal enabled) | cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:*:*:*:*:*:* | 11.1.0 through 11.1.2 (fixed in 11.1.2-h3) |
What does this mean for affected devices?
CVE-2024-3400 affects the GlobalProtect gateway or portal feature of Palo Alto Networks PAN-OS. An unauthenticated attacker can send a crafted request that creates an arbitrary file, which can then be used to execute commands with root privileges on the firewall (NVD).
NVD scores the flaw CVSS v3.1 10.0 (critical) — network-reachable, low attack complexity, no privileges or user interaction required, and a full compromise of confidentiality, integrity and availability (NVD).
CISA added CVE-2024-3400 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-04-12, the same day it was published, and records known use in ransomware campaigns (CISA KEV).
Palo Alto Networks' own advisory lists PAN-OS 10.2 (10.2.0 through 10.2.9, fixed in 10.2.9-h1), 11.0 (11.0.0 through 11.0.4, fixed in 11.0.4-h1) and 11.1 (11.1.0 through 11.1.2, fixed in 11.1.2-h3) as affected when the GlobalProtect gateway or portal is enabled; Cloud NGFW, Panorama appliances and Prisma Access are not affected (Palo Alto Networks Security Advisory).
As of 2026-10-19, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9999, 100th percentile), consistent with a vulnerability that remains under mass scanning more than two years after disclosure (FIRST EPSS).
Devices on an affected PAN-OS branch should be updated to a fixed hotfix release; where patching is not immediately possible, the vendor advisory above describes interim mitigations such as disabling GlobalProtect or enabling the relevant Threat Prevention signatures.
Evidence
- Unauthenticated command injection in PAN-OS GlobalProtect allows arbitrary file creation and root code execution. — NVD
- NVD CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-04-12 with known ransomware campaign use. — CISA KEV
- Affected: PAN-OS 10.2.0-10.2.9, 11.0.0-11.0.4, 11.1.0-11.1.2 with GlobalProtect enabled; Cloud NGFW, Panorama and Prisma Access are not affected. — Palo Alto Networks Security Advisory
- EPSS score is 0.9999 (100th percentile) as of 2026-10-19. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Why is CVE-2024-3400 scored at the maximum possible CVSS value?
NVD scores CVE-2024-3400 at the maximum possible CVSS v3.1 value, 10.0, because every exploitability and impact metric sits at its worst-case setting: network-reachable, low complexity, no privileges or user interaction needed, and complete loss of confidentiality, integrity and availability from root-level code execution, per NVD.
How quickly did CISA add CVE-2024-3400 to its Known Exploited Vulnerabilities catalog after publication?
CISA added CVE-2024-3400 to the KEV catalog on 2024-04-12, the same day the CVE was published — one of the fastest KEV additions on this site, consistent with exploitation already being observed before public disclosure, per CISA KEV.
Which Palo Alto product lines are confirmed unaffected by CVE-2024-3400?
Palo Alto's advisory confirms Cloud NGFW, Panorama appliances and Prisma Access are not affected by CVE-2024-3400 — the vulnerability is scoped to on-premises PAN-OS firewalls running the GlobalProtect gateway or portal feature, per Palo Alto Networks Security Advisory.
What can an organization do about CVE-2024-3400 if it cannot apply the hotfix immediately?
Palo Alto's advisory describes interim mitigations for devices that cannot be hotfixed right away, including disabling the GlobalProtect gateway/portal feature entirely or enabling the relevant Threat Prevention signatures, per Palo Alto Networks Security Advisory.
Questions about this page?