CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection

Exploited in the wild Critical 10.0 Published 12 Apr 2024 Updated 21 Oct 2025

Unauthenticated attackers can execute arbitrary code with root privileges on PAN-OS firewalls via command injection in GlobalProtect.

Exploited in the wild: Since 12 Apr 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3400?

CVE-2024-3400 is a critical command injection vulnerability in Paloaltonetworks Pan-Os, published on 12 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Weakness: CWE-77, CWE-20

Which versions are affected by CVE-2024-3400?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2024-3400?

No fix has been published for CVE-2024-3400 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Apr 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-3400 being exploited?

Yes. Attackers have exploited CVE-2024-3400 in the wild since at least 12 Apr 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 45 proofs of concept on GitHub.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-v475-xhc9-wfxg.