CVE-2024-0012
Palo Alto Networks PAN-OS: Management Interface Authentication Bypass
As of , CVE-2024-0012 in Palo Alto Networks PAN-OS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 18 November 2024
- US federal deadline
- 9 December 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- KnownCISA changed it from Unknown to Known on 12 May 2025.
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- No score that dayThe EPSS file of the day CISA listed it has no score for it.
- Public exploit
- 1 Metasploit module
- Fix
- Vendor advice: security.paloaltonetworks.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
CISA's required action
What the flaw is
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
CISA's description
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
The CVE record's description, from palo_alto
- CVE published
- 18 November 2024
- Assigned by
- palo_alto
- CVSS
- 9.3 Critical (CVSS 4.0, from the CNA)
- CWE-306
- Missing Authentication for Critical Function
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
- CISA changed its entry. Ransomware use: Unknown to Known.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Executionexploit module, rank excellent
PAN-OS: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2026-0257Authentication Bypass | Palo Alto Networks PAN-OS | Patch nowRansomware use, listed within a year | 0.97 | ||
| CVE-2017-15944Remote Code Execution | Palo Alto Networks PAN-OS | Patch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry | 0.98 | ||
| CVE-2024-9474Management Interface OS Command Injection | Palo Alto Networks PAN-OS | Patch this weekRansomware use; Metasploit module; EPSS 0.95 | 0.95 | ||
| CVE-2024-3400Command Injection | Palo Alto Networks PAN-OS | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2025-0108Authentication Bypass | Palo Alto Networks PAN-OS | Patch this weekEPSS 0.98 | 0.98 | ||
| CVE-2019-1579Remote Code Execution | Palo Alto Networks PAN-OS | Patch this weekRansomware use | 0.46 | ||
| CVE-2020-2021Authentication Bypass | Palo Alto Networks PAN-OS | Patch this weekRansomware use | 0.04 | ||
| CVE-2026-0300Out-of-bounds Write | Palo Alto Networks PAN-OS | Patch soon | 0.32 | ||
| CVE-2024-3393Malicious DNS Packet | Palo Alto Networks PAN-OS | Patch soon | 0.29 | ||
| CVE-2022-0028Reflected Amplification Denial-of-Service | Palo Alto Networks PAN-OS | Patch soon | 0.03 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org