CVE-2024-9474: PAN-OS Management Interface OS Command Injection Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and allows root-level compromise of a perimeter security device.

What it is

PAN-OS contains an OS command injection flaw (CWE-78) in the management web interface that lets an authenticated administrator execute actions on the firewall with root privileges. It matters because a lower-privileged management user can gain full root control of the device, and the flaw is being exploited in the wild.

Impact

An attacker with administrator access to the management web interface gains root-level execution on the firewall, enabling full control of the device and its configuration. This can lead to data theft, configuration tampering, or use of the firewall as a foothold in the network.

Attack surface

Reached over the network via the PAN-OS management web interface (CVSS 4.0 AV:N). It requires high privileges (PR:H) and no user interaction (UI:N), so an attacker must already hold a valid administrator account on the management interface.

Exploitation

Listed in CISA KEV (added 2024-11-18, due 2024-12-09) with known ransomware campaign use, and EPSS 30-day probability is 0.94701 (99.85th percentile). Public exploit references exist, including a GitHub PoC and third-party analysis, indicating active exploitation.

What to do

• Apply the vendor patch for PAN-OS per the Palo Alto Networks advisory as the first action.
• Restrict management web interface access to trusted internal networks only; never expose it to the internet.
• Enforce least privilege on PAN-OS administrator accounts and audit existing admin users.
• Monitor and restrict access to the management interface using firewall rules or jump hosts.
• If patching is not immediately possible, follow CISA KEV required actions or discontinue use of the affected product.

Detection

• Monitor PAN-OS management interface logs for unexpected command execution or anomalous admin activity.
• Alert on new or unusual administrator accounts and privilege changes on the firewall.
• Hunt for outbound connections or process activity on the firewall consistent with post-exploitation root access.
• Review authentication logs for management interface access from untrusted or unexpected source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.