CVE-2024-3388
PAN-OS: User Impersonation in GlobalProtect SSL VPN
- Published
- Updated
- Reserved
- Assigned by
- palo_alto
Description
A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.
Timeline
ID reserved
By palo_alto
- 5 days later
· 5 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| palo_altoCNA (assigner) | 3.1 | Medium4.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.35% · top 71% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.1.
Weakness
Affected products
- affected 8.1.0 – < 8.1.26
- affected 9.0.0 – < 9.0.17-h4
- affected 9.1.0 – < 9.1.17
- affected 10.1.0 – < 10.1.11-h4
- affected 10.2.0 – < 10.2.7-h3
- affected 11.0.0 – < 11.0.3
- unaffected 11.1.0
Palo Alto Networks · Cloud NGFW
- unaffected All
Palo Alto Networks · Prisma Access
- affected 10.2 – < 10.2.4
What to do
Solution: This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h4, PAN-OS 9.1.17, PAN-OS 10.1.11-h4, PAN-OS 10.2.7-h3, PAN-OS 11.0.3, and all later PAN-OS versions. This issue is fixed in Prisma Access 10.2.4 and later.
Workaround: You can enable the "Disable Automatic Restoration of SSL VPN" (Network > GlobalProtect Gateways > > GlobalProtect Gateway Configuration > Agent > Connection Settings) on PAN-OS firewalls with the GlobalProtect feature enabled to mitigate this vulnerability.
Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-3388)Record last updated .