What is the GHSA ID for CVE-2024-3400?

GitHub tracks CVE-2024-3400 as GHSA-v475-xhc9-wfxg.

What is the CVSS score of CVE-2024-3400?

CVE-2024-3400 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Other published scores: CVSS 3.1 10.0.

Which versions are affected by CVE-2024-3400?

Palo Alto Networks PAN-OS (Vendor product): >= 10.2.0, = 11.0.0, = 11.1.0, < 11.1.2-h3. Palo Alto Networks Cloud NGFW (Vendor product): version range not published. Palo Alto Networks Prisma Access (Vendor product): version range not published.

How do I fix CVE-2024-3400?

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

Is CVE-2024-3400 exploited in the wild?

CISA lists it as a known exploited vulnerability (added 12 Apr 2024). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

CVE-2024-3400GHSA-v475-xhc9-wfxg

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Q: How do I fix CVE-2024-3400?

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

Q: Is CVE-2024-3400 exploited in the wild?

CISA lists it as a known exploited vulnerability (added 12 Apr 2024). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

CVE-2024-3400 (GitHub advisory GHSA-v475-xhc9-wfxg) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Input Validation (CWE-20), in Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW and Palo Alto Networks Prisma Access. No fixed version has been published yet. CISA lists it as a known exploited vulnerability (added 12 Apr 2024).

Critical9.8Known exploitedNo fix yetUnreviewed advisory

Published 12 Apr 2024Updated 22 Oct 2025

9.8CriticalCVSS 3.1

CVE ID: CVE-2024-3400
GHSA ID: GHSA-v475-xhc9-wfxg
EPSS: 99.99%higher than 99.9% of CVEs
Weaknesses (CWE): CWE-20Improper Input Validation
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
KEV status: Known exploitedAdded 12 Apr 2024
Published: 12 Apr 2024
Updated: 22 Oct 2025
Ecosystem: Vendor product
Assigned by (CNA): palo_alto

Summary

Source: GitHub Advisory Database

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Fixes for PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 are in development and are expected to be released by April 14, 2024. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Critical9.8Base score from GitHub Advisory Database

Attack Vector AV: Network
Attack Complexity AC: Low
Privileges Required PR: None
User Interaction UI: None
Scope S: Unchanged
Confidentiality C: High
Integrity I: High
Availability A: High

CISA SSVC decision points

Exploitation: active; Exploited in the wild
Automatable: yes; Attackers can automate this at scale
Technical impact: total; Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

CISA required action

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Federal agencies must remediate by 19 Apr 2024. Used in ransomware campaigns.

Affected packages

Source: CVE.org

Palo Alto Networks PAN-OS
Vendor product
No PURL published
Affected versions
>= 10.2.0, < 10.2.9-h1
>= 11.0.0, < 11.0.4-h1
>= 11.1.0, < 11.1.2-h3
Fixed in
No fix yet
Palo Alto Networks Cloud NGFW
Vendor product
No PURL published
Affected versions
See summary
Fixed in
No fix yet
Palo Alto Networks Prisma Access
Vendor product
No PURL published
Affected versions
See summary
Fixed in
No fix yet

Package	Affected versions	Fixed in
Palo Alto Networks PAN-OS Vendor product No PURL published	>= 10.2.0, < 10.2.9-h1 >= 11.0.0, < 11.0.4-h1 >= 11.1.0, < 11.1.2-h3	No fix yet
Palo Alto Networks Cloud NGFW Vendor product No PURL published	See summary	No fix yet
Palo Alto Networks Prisma Access Vendor product No PURL published	See summary	No fix yet

Fix

Source: CVE.org

No fixed version has been published

Every version in the affected ranges above is vulnerable. Look for mitigations in the advisory and references, and watch the vendor for a release.

Vulnerability intelligence

References

Advisories 3

Write-ups 3

Credits

Palo Alto Networks thanks Volexity for detecting and identifying this issue.finder
Capability Development Group at Bishop Fox for helping us verify the fixes and improve threat prevention signatures.remediation verifier

Questions about CVE-2024-3400

What is the GHSA ID for CVE-2024-3400?: GitHub tracks CVE-2024-3400 as GHSA-v475-xhc9-wfxg.
What is the CVSS score of CVE-2024-3400?: CVE-2024-3400 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Other published scores: CVSS 3.1 10.0.
Which versions are affected by CVE-2024-3400?: Palo Alto Networks PAN-OS (Vendor product): >= 10.2.0, < 10.2.9-h1; >= 11.0.0, < 11.0.4-h1; >= 11.1.0, < 11.1.2-h3. Palo Alto Networks Cloud NGFW (Vendor product): version range not published. Palo Alto Networks Prisma Access (Vendor product): version range not published.
How do I fix CVE-2024-3400?: No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.
Is CVE-2024-3400 exploited in the wild?: CISA lists it as a known exploited vulnerability (added 12 Apr 2024). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

OSV (GitHub advisory)No record
GitHub Advisory DatabaseLoadedRaw JSON
OSV (CVE record)No record
CVE.orgLoaded
CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 13:58 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description: GitHub Advisory Database
Severity score: GitHub Advisory Database
Weakness (CWE): GitHub Advisory Database
Affected packages: CVE.org
Fix: CVE.org
References: Computed by CVEminer
SSVC: CVE.org
KEV status: CISA KEV catalog
EPSS: GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.