CVE-2024-3400: Palo Alto PAN-OS GlobalProtect unauthenticated RCE, root-level
The short version: Palo Alto's PAN-OS — the operating system on their firewalls — has a command-injection flaw in the GlobalProtect VPN feature (CVE-2024-3400) that lets an unauthenticated attacker execute commands as root. It scores a perfect 10.0, it was exploited as a zero-day before Palo Alto shipped a patch, and it's in CISA's KEV catalog. If you run GlobalProtect on an affected build, this is patch-and-verify, not patch-and-forget. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~99.99% · 100th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2024-04-19 |
| Known exploited? | Yes — exploited as a zero-day (Operation MidnightEclipse) before the fix |
| Vulnerability type | CWE-77 command injection (via arbitrary file creation) → unauthenticated remote code execution as root |
| Requires authenticated session? | No — pre-authentication |
| Affected | PAN-OS 10.2.0–10.2.9-h1, 11.0.0–11.0.4-h1, 11.1.0–11.1.2-h3 with a GlobalProtect gateway or portal configured |
| Fixed in | PAN-OS 10.2.9-h1 · 11.0.4-h1 · 11.1.2-h3 (and later) |
| Not affected | Cloud NGFW, Panorama, and Prisma Access |
What you need to know
CVE-2024-3400 is a command injection in the GlobalProtect feature of PAN-OS. An unauthenticated attacker sends a crafted request that causes the firewall to create an attacker-controlled file, and that file is then executed — yielding arbitrary command execution with root privileges on the device.
This is about as bad as external exposure gets, and the target makes it worse:
- It's the firewall itself. Root on the perimeter device means the attacker controls the thing that's supposed to be enforcing your controls — traffic, rules, and the boundary all at once.
- It's pre-authentication and trivially reachable. GlobalProtect portals are meant to be internet-facing so remote users can connect. No credential, no chain.
- It was live before the fix. Palo Alto and Volexity documented in-the-wild exploitation (a campaign tracked as Operation MidnightEclipse, deploying a Python backdoor) before a patch existed — so an affected appliance may have been touched pre-patch.
How serious we see it
Critical — the 10.0 is not hyperbole here.
Unauthenticated, network-reachable, root-level code execution on a security appliance, confirmed exploited in the wild, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it only affects specific PAN-OS builds with GlobalProtect configured, common management platforms (Panorama, Prisma Access, Cloud NGFW) aren't affected, and the fixes are out. The catch is the same as any pre-patch zero-day — being patched and being clean are separate questions.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to PAN-OS 10.2.9-h1 / 11.0.4-h1 / 11.1.2-h3 or later.
- Assume nothing given the zero-day window — hunt. Follow Palo Alto's guidance to check for indicators of compromise, and determine whether the appliance was exploited before you patched.
- If you find indicators, respond fully. Palo Alto's guidance has distinguished levels of compromise; where warranted, perform a private-data reset / rebuild and rotate all credentials, keys, and certificates on the device.
- Harden exposure. Limit who can reach the GlobalProtect portal and the management interface from the internet; never expose the management plane publicly.
- Confirm your exposure first. Verify whether you run an affected PAN-OS build with GlobalProtect configured at all.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected firewall? — from the outside in. Starting from little more than your domain, it discovers internet-facing GlobalProtect portals, fingerprints the PAN-OS product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top of your results because it's in KEV.
That outside-in, continuous view is the whole point: when a firewall zero-day breaks, you don't start by inventorying what you own — the exposed appliance is already mapped, so you can go straight to patch-and-verify.