CVE Vulnerability Advisory Database

[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).

[Impact] Unauthenticated attackers can bypass security restrictions to establish unauthorized VPN connections and gain access to internal network resources.

[Mitigation] Apply the official security patches immediately, and restrict access to GlobalProtect interfaces until fully patched.

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] Palo Alto Networks PAN-OS software management web interface (excluding Cloud NGFW and Prisma Access)

[Impact] Unauthenticated remote attackers with network access can bypass authentication on the management interface and invoke sensitive PHP scripts, severely compromising system integrity and confidentiality

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only

[Affected Scope] Palo Alto Networks firewall appliances running PAN-OS 10.2, 11.0, 11.1, and 11.2 with the management web interface exposed to the network.

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative privileges, modify configurations, or chain with other privilege escalation flaws like CVE-2024-9474 to compromise the system.

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only.

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures

[Affected Scope] PAN-OS 8.1, 9.0, and 9.1 versions, Panorama, and GlobalProtect gateways with SAML authentication enabled and 'Validate Identity Provider Certificate' disabled

[Impact] Unauthenticated remote attackers can bypass SAML signature verification to gain administrative access to PAN-OS/Panorama web interfaces or access protected network resources

[Mitigation] Upgrade PAN-OS to patched versions (9.1.3, 9.0.9, 8.1.15 or later) or enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile

[Affected Scope] PAN-OS versions before 6.1.19, 7.0.19, 7.1.14, and 8.0.6 management interface

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the management interface, leading to complete device compromise

[Mitigation] Immediately upgrade to the patched versions and restrict access to the management interface from the public internet