CVE Vulnerability Advisory Database

[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS

[Impact] An authenticated attacker with network access can execute arbitrary code with root privileges, leading to full system compromise

[Mitigation] Apply the latest security patches immediately and restrict management interface access to trusted internal IP addresses only

[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).

[Impact] Unauthenticated attackers can bypass security restrictions to establish unauthorized VPN connections and gain access to internal network resources.

[Mitigation] Apply the official security patches immediately, and restrict access to GlobalProtect interfaces until fully patched.

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] PAN-OS firewalls with the management web interface enabled and accessible via the network (excluding Cloud NGFW and Prisma Access)

[Impact] Authenticated attackers can read sensitive system files on the PAN-OS filesystem that are readable by the 'nobody' user, potentially exposing configuration details

[Mitigation] Apply the latest PAN-OS security patches immediately and restrict management interface access to trusted internal IP addresses

[Affected Scope] Palo Alto Networks PAN-OS software management web interface (excluding Cloud NGFW and Prisma Access)

[Impact] Unauthenticated remote attackers with network access can bypass authentication on the management interface and invoke sensitive PHP scripts, severely compromising system integrity and confidentiality

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only

[Affected Scope] Palo Alto Networks PAN-OS software versions with the DNS Security feature enabled

[Impact] An unauthenticated remote attacker can send malicious packets through the data plane, causing the firewall to reboot. Repeated exploitation forces the device into maintenance mode, leading to a complete network outage

[Mitigation] Immediately upgrade PAN-OS to the patched versions recommended by the vendor, and review DNS Security profile configurations as a temporary measure

[Affected Scope] Authenticated administrators with access to the PAN-OS management web interface

[Impact] Complete system compromise via arbitrary OS command execution with root privileges on the firewall

[Mitigation] Apply official security patches immediately and restrict access to the management interface from the public internet

[Affected Scope] Palo Alto Networks firewall appliances running PAN-OS 10.2, 11.0, 11.1, and 11.2 with the management web interface exposed to the network.

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative privileges, modify configurations, or chain with other privilege escalation flaws like CVE-2024-9474 to compromise the system.

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only.

[Affected Scope] Palo Alto Networks Expedition migration tool versions prior to 1.2.96

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands as root, leading to the exposure of PAN-OS firewall usernames, cleartext passwords, device configurations, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.96 or later, and rotate all potentially exposed firewall credentials and API keys

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures