Page generated: 07 Nov 2026, 04:24 UTC
← Dashboard

CVE-2024-3400

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root …

Read full description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 26 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

CyberSecurityNews
Press · 30 Sep 2025, 07:00 · Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability - CyberSecurityNews
GreyNoise
Press · 26 Feb 2025, 08:00 · GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs - GreyNoise
Rapid7
Press · 03 Jan 2025, 08:00 · Metasploit 2024 Annual Wrap-Up - Rapid7
watchTowr Labs
Press · 19 Nov 2024, 08:00 · Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 - watchTowr Labs
Arctic Wolf
Press · 07 Oct 2024, 07:00 · Anatomy of a Cyber Attack: The PAN-OS Firewall Zero-Day - Arctic Wolf
See all 26 source documents
Akamai
Press · 30 May 2024, 07:00 · RedTail Cryptominer Threat Actors Adopt PAN-OS CVE-2024-3400 Exploit - Akamai
cyfirma
Press · 02 May 2024, 07:00 · Emerging Security Threats : Analysis of CVE-2024-3400 - cyfirma
Help Net Security
Press · 30 Apr 2024, 07:00 · Palo Alto firewalls: CVE-2024-3400 exploitation and PoCs for persistence after resets/upgrades - Help Net Security
CyberPeace Foundation
Press · 29 Apr 2024, 07:00 · ‍CVE-2024-3400: Critical Vulnerability Hits Palo Alto Networks Firewalls - CyberPeace Foundation
SecurityWeek
Press · 25 Apr 2024, 07:00 · Palo Alto Networks Shares Remediation Advice for Hacked Firewalls - SecurityWeek
Kroll
Press · 23 Apr 2024, 07:00 · CVE-2024-3400: Zero-Day Remote Code Execution Vulnerability Exploited to Attack PAN-OS - Kroll
National Cyber Security Centre
Press · 22 Apr 2024, 07:00 · Exploitation of vulnerability affecting Palo Alto GlobalProtect Gateway - National Cyber Security Centre
Palo Alto Networks
Press · 19 Apr 2024, 07:00 · More on the PAN-OS CVE-2024-3400 - Palo Alto Networks
BleepingComputer
Press · 19 Apr 2024, 07:00 · 22,500 Palo Alto firewalls "possibly vulnerable" to ongoing attacks - BleepingComputer
www.thestack.technology
Press · 17 Apr 2024, 07:00 · PAN-OS vuln mitigation howler: “Disabling telemetry” no help - www.thestack.technology
TechCrunch
Press · 17 Apr 2024, 07:00 · Palo Alto Networks’ firewall bug under attack brings fresh havoc to thousands of companies - TechCrunch
SOC Prime
Press · 17 Apr 2024, 07:00 · CVE-2024-3400 Detection: A Maximum Severity Command Injection PAN-OS Zero-Day Vulnerability in GlobalProtect Software - SOC Prime
GreyNoise
Press · 15 Apr 2024, 07:00 · CVE-2024-3400: Command Injection Vulnerability in Palo Alto Networks PAN-OS - GreyNoise
The Hacker News
Press · 15 Apr 2024, 07:00 · Palo Alto Networks Releases Urgent Fixes for Exploited PAN-OS Vulnerability - The Hacker News
Security Affairs
Press · 15 Apr 2024, 07:00 · Threat actors exploited Palo Alto Pan-OS issue to deploy a Python Backdoor - Security Affairs
The Record from Recorded Future News
Press · 15 Apr 2024, 07:00 · Palo Alto Networks releases fixes for zero-day as attackers swarm VPN vulnerability - The Record from Recorded Future News
Arctic Wolf
Press · 14 Apr 2024, 07:00 · Follow Up: CVE-2024-3400 - Arctic Wolf
SecurityWeek
Press · 12 Apr 2024, 07:00 · State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls - SecurityWeek
Unit 42
Press · 12 Apr 2024, 07:00 · Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 (Updated May 20) - Unit 42
SecurityWeek
Press · 12 Apr 2024, 07:00 · Palo Alto Networks Warns of Exploited Firewall Vulnerability - SecurityWeek
Rapid7
Press · 12 Apr 2024, 07:00 · CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls - Rapid7

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

6

Public exploit entries / repo candidates

See 6 repos with metrics
RepositoryStarsForksLanguageUpdated
retkoussa/CVE-2024-340050Python17 Apr 2024, 23:46
CerTusHack/CVE-2024-3400-PoC20Shell13 Apr 2024, 20:51
CONDITIONBLACK/CVE-2024-3400-POC20Python16 Apr 2024, 17:18
GhassanSabir/CVE-2024-3400-poc00—10 Jan 2025, 02:22
Ravaan21/CVE-2024-340000Rust18 Apr 2024, 21:21
tfrederick74656/cve-2024-3400-poc00—17 Apr 2024, 21:06
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 100.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:13.649296+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
12 Apr 2024, 00:00
First press mention
12 Apr 2024, 07:00
Published
12 Apr 2024, 07:20
Latest press mention
30 Sep 2025, 07:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
6 repositories