CVE-2024-3400: PAN-OS GlobalProtect command injection allows unauthenticated root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote root code execution on an internet-facing firewall, actively exploited as a zero-day, in CISA KEV with ransomware use noted and an EPSS near 1.0.

What it is

A command injection caused by arbitrary file creation in the GlobalProtect feature of Palo Alto Networks PAN-OS lets an unauthenticated attacker run arbitrary code as root on the firewall. Only specific PAN-OS versions and feature configurations are affected; Cloud NGFW, Panorama appliances and Prisma Access are not impacted. Because the target is an internet-facing security appliance, compromise gives an attacker a privileged foothold at the network edge.

Impact

An attacker gains root-level code execution on the firewall, allowing full control of the device and its traffic handling. That position can be used to intercept or alter network traffic and to pivot into protected internal networks.

Attack surface

Reachable over the network through the GlobalProtect feature with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Only devices running the affected PAN-OS versions with the relevant GlobalProtect configuration are exposed.

Exploitation

Exploited in the wild as a zero-day, listed in CISA KEV on 2024-04-12 with a 2024-04-19 remediation due date and flagged for known ransomware campaign use. EPSS is 0.99999 (100th percentile), and vendor and third-party references are tagged as exploit write-ups.

What to do

• Apply the PAN-OS patch from the vendor advisory as soon as it is available for your version.
• If patching is not immediately possible, enable the vendor-provided Threat Prevention IDs as directed in the CISA KEV required action and vendor bulletin.
• Restrict or disable GlobalProtect access from untrusted networks until the device is patched.
• Check the vendor advisory to confirm whether your specific PAN-OS version and GlobalProtect configuration are affected, since only distinct configurations are vulnerable.
• Treat any internet-exposed, unpatched GlobalProtect interface as compromised and review it for signs of intrusion.

Detection

• Hunt firewall and GlobalProtect logs for unusual requests or file creation activity preceding command execution.
• Monitor for unexpected outbound connections or new processes on PAN-OS management and dataplane interfaces.
• Review the vendor and Unit 42 threat research for indicators of compromise and search logs for those patterns.
• Alert on configuration or file changes on the firewall outside of approved change windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.