CVE-2024-0012: PAN-OS Management Web Interface Authentication Bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable admin takeover with CVSS 9.3, KEV listing, ransomware use, and near-certain EPSS exploitation probability.

What it is

PAN-OS contains a missing authentication flaw (CWE-306) in the management web interface that lets an unauthenticated network attacker obtain PAN-OS administrator privileges. Because it grants full administrative control, it can be used to alter configuration or chain into authenticated privilege escalation issues such as CVE-2024-9474. Only PAN-OS 10.2, 11.0, 11.1, and 11.2 are affected; Cloud NGFW and Prisma Access are not.

Impact

An attacker gains PAN-OS administrator privileges, enabling configuration tampering and administrative actions, and can pivot to further authenticated privilege escalation vulnerabilities. This effectively hands over control of the firewall's management plane.

Attack surface

Reached over the network via the management web interface (CVSS 4.0 AV:N, PR:N, UI:N), so no authentication or user interaction is required. Exposure is limited to management interfaces reachable by the attacker; restricting management access to trusted internal IPs greatly reduces risk.

Exploitation

CISA added it to KEV on 2024-11-18 with a 2024-12-09 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99718 (99.951st percentile), and a third-party advisory is tagged Exploit.

What to do

• Apply the vendor patches for PAN-OS 10.2, 11.0, 11.1, and 11.2 per the Palo Alto Networks advisory.
• Immediately restrict management web interface access to trusted internal IP addresses only; do not expose it to the internet or untrusted networks.
• If patching is not immediately possible, follow vendor mitigation guidance or discontinue use of the affected product as directed by CISA.
• Audit for signs of prior compromise and rotate administrative credentials after remediation.
• Verify Cloud NGFW and Prisma Access are unaffected and exclude them from emergency change scope.

Detection

• Monitor management web interface access logs for unauthenticated or anomalous requests, especially from unexpected source IPs.
• Alert on new or modified administrative accounts, configuration changes, and unexpected admin logins on PAN-OS devices.
• Hunt for exploitation attempts and post-exploitation activity tied to CVE-2024-0012 and chained CVE-2024-9474 using the Unit 42 and WatchTowr technical write-ups.
• Review network exposure to confirm no management interface is reachable from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.