Palo Alto Networks PAN-OS Command Injection Vulnerability (CVE-2024-3400)
Severity: critical · Patch status: unknown · Since 2024-04-12 · CVE-2024-3400
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities catalog on Apr 12, 2024, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
- US federal agencies must remediate by Apr 19, 2024 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
