CVE-2024-9474: Palo Alto PAN-OS privilege escalation to root, actively exploited
The short version: CVE-2024-9474 is a privilege-escalation flaw in PAN-OS: an administrator with access to the management web interface can run commands on the firewall with root privileges. On its own it needs admin access — but in the wild it was chained with CVE-2024-0012 (unauthenticated auth bypass) so an attacker could go from no credentials to root. It's confirmed exploited and in CISA's KEV catalog. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice, chained to full compromise (see below) |
| CVSS v3.1 (NVD) | 7.2 — High · AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Palo Alto, v4.0) | 6.9 — Medium (urgency: highest) |
| EPSS | ~94.77% · 99.85th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2024-12-09 |
| Known exploited? | Yes — chained with CVE-2024-0012 (Operation Lunar Peek); public PoCs exist |
| Vulnerability type | CWE-78 OS command injection → privilege escalation to root |
| Requires authenticated session? | Yes — requires PAN-OS administrator access to the management interface (supplied by the chained auth bypass in the wild) |
| Affected | PAN-OS 10.1, 10.2, 11.0, 11.1, 11.2 branches — see Palo Alto's advisory for exact builds |
| Fixed in | PAN-OS 10.1.14-h6 · 10.2.12-h2 · 11.0.6-h1 · 11.1.5-h1 · 11.2.4-h1 (and later) |
What you need to know
CVE-2024-9474 is an OS command injection in the PAN-OS management web interface. A user with administrator access can use it to run commands as root — full control of the appliance. Read narrowly, it requires you to already be an admin, which is why the base metrics are mid-range.
The reason it's high-priority is how it was used:
- It's the back half of a takeover chain. Attackers paired it with CVE-2024-0012, an unauthenticated authentication bypass, so the "admin access" requirement was satisfied by the first bug — turning the pair into unauthenticated to root on exposed firewalls.
- It's confirmed exploited (Operation Lunar Peek), with public proof-of-concept code and a very high EPSS.
How serious we see it
High — in practice.
The isolated scores (NVD 7.2; Palo Alto's CVSS v4.0 6.9, urgency highest) reflect the admin-access prerequisite. But in the real world that prerequisite was handed over for free by CVE-2024-0012, producing full root compromise of internet-reachable firewalls — confirmed exploited and KEV-listed. We rate it by that reality. The bounded, reassuring part: it affects specific PAN-OS builds, fixes are out, and keeping the management interface off the public internet breaks the chain that makes it dangerous.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to PAN-OS 10.1.14-h6 / 10.2.12-h2 / 11.0.6-h1 / 11.1.5-h1 / 11.2.4-h1 or later.
- Restrict the management interface to trusted internal IPs. This breaks the CVE-2024-0012 → CVE-2024-9474 chain.
- Hunt. Follow Palo Alto's guidance to check for indicators of compromise from the chained attack.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether an affected PAN-OS management interface is reachable at all.
How BreachRisk sees it
BreachRisk discovers internet-facing PAN-OS management interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top because it's part of an in-the-wild root chain.
That continuous, outside-in view is the point: the exposed interface is already mapped, so when a firewall takeover chain breaks you can go straight to patch-and-verify.