CVE-2024-0012: Palo Alto PAN-OS management-interface authentication bypass, actively exploited
The short version: CVE-2024-0012 lets an unauthenticated attacker with network access to the PAN-OS management web interface bypass authentication and gain administrator privileges on the firewall. Attackers chained it with the privilege-escalation flaw CVE-2024-9474 to reach root, in a campaign Palo Alto tracked as Operation Lunar Peek. It's in CISA's KEV catalog. If your management interface is reachable, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Palo Alto) | 9.3 — Critical |
| EPSS | ~99.70% · 99.95th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2024-12-09 |
| Known exploited? | Yes — actively exploited (Operation Lunar Peek), chained with CVE-2024-9474 |
| Vulnerability type | CWE-306 missing authentication for critical function → unauthenticated PAN-OS administrator access |
| Requires authenticated session? | No — pre-authentication |
| Affected | PAN-OS 10.2 < 10.2.12, 11.0 < 11.0.6, 11.1 < 11.1.5, 11.2 < 11.2.4 with the management web interface reachable |
| Fixed in | PAN-OS 10.2.12-h2 · 11.0.6-h1 · 11.1.5-h1 · 11.2.4-h1 (and later) |
| Not affected | Cloud NGFW and Prisma Access |
What you need to know
PAN-OS is the operating system on Palo Alto Networks firewalls. CVE-2024-0012 is a missing-authentication flaw in the management web interface: an attacker who can reach that interface over the network can act as a PAN-OS administrator without credentials — reading and changing configuration, and setting up the next stage of an intrusion.
Why it belongs at the top of the queue:
- It's the firewall's control plane. Administrator access to the perimeter device means control over the rules meant to protect everything behind it.
- It was chained to root. In the wild, attackers paired it with CVE-2024-9474 (privilege escalation) to move from admin to root command execution on the appliance.
- It's confirmed exploited. Palo Alto and CISA documented active exploitation, and the fix window came with a firm federal deadline.
How serious we see it
Critical — the score isn't hyperbole here.
Unauthenticated administrator access on an internet-reachable firewall management plane, confirmed exploited and chained to root, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific PAN-OS builds, Cloud NGFW and Prisma Access aren't affected, and the single most effective control — never exposing the management interface to the internet — is entirely in your hands.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to PAN-OS 10.2.12-h2 / 11.0.6-h1 / 11.1.5-h1 / 11.2.4-h1 or later.
- Get the management interface off the internet. Restrict it to trusted internal IPs per Palo Alto's best-practice guidance — this defeats the attack outright.
- Hunt. Follow Palo Alto's guidance to check for indicators of compromise, especially signs of the CVE-2024-0012 → CVE-2024-9474 chain.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether an affected PAN-OS management interface is reachable at all.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected firewall interface? — from the outside in. Starting from little more than your domain, it discovers internet-facing PAN-OS management interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top because it's in KEV.
That outside-in, continuous view is the whole point: when a firewall auth-bypass breaks, the exposed interface is already mapped, so you can go straight to patch-and-verify.