Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability (CVE-2024-0012) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTPalo Alto Networks firewall appliances running PAN-OS 10.2, 11.0, 11.1, and 11.2 with the management web interface exposed to the network.
Unauthenticated remote attackers can bypass authentication to gain administrative privileges, modify configurations, or chain with other privilege escalation flaws like CVE-2024-9474 to compromise the system.
Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade to the designated hotfix or maintenance release for your specific PAN-OS branch. Use the following CLI commands to download and apply the patch:
# Retrieve the latest software information
request system software info
# Download the secure patch version (e.g., 11.2.4-h1)
request system software download version 11.2.4-h1
# Install the downloaded software package
request system software install version 11.2.4-h1
# Reboot the system to apply the update
request restart system2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, isolate the management interface (MGT) from the public internet and restrict access to trusted administrative subnets.
# Restrict management interface access to trusted IPs via CLI
configure
set deviceconfig system services-protection-profile 'Admin-Access-Restriction'
set deviceconfig system services-protection-profile 'Admin-Access-Restriction' permitted-ip 10.50.10.0/24
commit3. Log Audit & IoC Verification Commands
Verify the current running version of PAN-OS and inspect the web backend logs for unauthorized access attempts or anomalous administrative activities.
# Check the current PAN-OS software version
show system info | match sw-version
# Monitor the web backend log for suspicious authentication bypass attempts
tail follow yes mp-log web-backend.logStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-0012) is an authentication bypass flaw in the management web interface of Palo Alto Networks PAN-OS software. Due to missing or insufficient authentication validation (CWE-306), an unauthenticated attacker with network access to the management interface can bypass security controls and perform administrative actions. Cloud NGFW and Prisma Access are confirmed to be unaffected by this issue.
2. Exploitation Mechanics & Attack Scenario
An attacker targeting an exposed management interface sends crafted HTTP requests designed to bypass the authentication handler. Once bypassed, the attacker gains PAN-OS administrator privileges. This access can be chained with post-authentication privilege escalation vulnerabilities, such as CVE-2024-9474, allowing the attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is actively exploited in the wild (CISA KEV listed) and carries an EPSS score of 0.9979.
3. Infrastructure & Business Impact
Firewalls serve as critical perimeter security boundaries. Compromising the firewall's management plane allows attackers to intercept or reroute network traffic, disable security policies, and establish persistent VPN backdoors into the internal corporate network. This poses an extreme risk of data exfiltration, ransomware deployment, and complete infrastructure compromise.
Official Vendor Advisories & References
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Frequently Asked SecOps Questions (CVE-2024-0012)
FAQQ1. How critical is CVE-2024-0012 and is it actively exploited in the wild?
CVE-2024-0012 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-0012?
Primary impacted vendors include paloaltonetworks across pan-os. Scope summary: PAN-OS 10.2 (prior to 10.2.12-h2), PAN-OS 11.0 (prior to 11.0.6-h1), PAN-OS 11.1 (prior to 11.1.5-h1), and PAN-OS 11.2 (prior to 11.2.4-h1).
Q3. What temporary mitigations or workarounds exist for CVE-2024-0012 before patching?
[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-0012
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)
[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS
TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.