A critical severity command injection vulnerability in Palo Alto Networks PAN-OS has been exploited in limited targeted attacks. While a fix is not yet available, patches are expected to be released on April 14 and mitigation steps are available.

CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

SANS Internet Storm Center has observed an increase in scans for this vulnerability. It has been persistently exploited. Apply patches if systems remain unpatched.

One of several CVEs identified by the NSA and other global agencies as being associated with People's Republic of China state-sponsored threat actor activity in August 2025.

Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access

Research shows over 22,500 Palo Alto GlobalProtect instances are possibly vulnerable to this flaw as a public proof-of-concept is available. Immediate patching is recommended.

Details on exploitation of this flaw are now available publicy and patches have begun being released by the vendor. Immediate patching is recommended.

Some hotfixes are now available. Exploitation remains limited to targeted attacks. Apply mitigations until additional hotfixes become available.

Researchers observed a threat actor, UTA0218, exploiting this flaw to deploy a backdoor called UPSTYLE. Apply available mitigations urgently until patches are available.

In the wild exploitation has been observed for this critical severity command injection affecting PAN-OS. Patches are expected soon.

Palo Alto PAN-OS versions 11.1.x < 11.1.0-h3 / 11.1.1-h1 / 11.1.2-h3, 11.0.x < 11.0.0-h3 / 11.0.1-h4 / 11.0.2-h4 / 11.0.3-h10 / 11.0.4-h1, 10.2.x < 10.2.0-h3 / 10.2.1-h2 / 10.2.2-h5 / 10.2.3-h13 / 10.2.4-h16 / 10.2.5-h6 / 10.2.6-h3 / 10.2.7-h8 / 10.2.8-h3 / 10.2.9-h1 suffer from an arbitrary file write vulnerability in the GlobalProtect feature, enabling a remote and unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration.

The version of Palo Alto Networks PAN-OS running on the remote host is affected by a command injection vulnerability as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114282	Palo Alto PAN-OS GlobalProtect Remote Code Execution	Web App Scanning	Component Vulnerability	Check Based	critical
193255	Palo Alto Networks PAN-OS CVE-2024-3400	Nessus	Palo Alto Local Security Checks	Combined	critical

Detections

Analytics

CVE-2024-3400

critical

Tenable Plugins

critical

critical