CVE-2024-8687 PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

What is CVE-2024-8687?

CVE-2024-8687 is a medium-severity vulnerability in Paloaltonetworks Pan-Os, published on 11 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Weakness: CWE-497

Which versions are affected by CVE-2024-8687?

It affects 3 products.

Products include Paloaltonetworks Globalprotect, Paloaltonetworks Pan-Os, Paloaltonetworks Prisma Access.

How do I fix CVE-2024-8687?

No fix has been published for CVE-2024-8687 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-8687 being exploited?

There is no known exploitation of CVE-2024-8687 in the wild and no public exploit code.

Other vulnerabilities in Paloaltonetworks Pan-Os

• CVE-2025-4232 GlobalProtect: Authenticated Code Injection Through Wildcard on macOS High 8.5
• CVE-2021-3057 GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway High 8.1
• CVE-2023-0009 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability High 7.8
• CVE-2022-0016 GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon High 7.4
• CVE-2025-0120 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability High 7.1

All Paloaltonetworks Pan-Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r589-95v2-93xr.