PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Description

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Scores

EPSS (exploitation in 30 days)

93.8% · top 0.2% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• Palo Alto Networks · Cloud NGFW

  • unaffected All

• Palo Alto Networks · PAN-OS

  • affected 11.2.0 – < 11.2.4-h1
  • affected 11.1.0 – < 11.1.5-h1
  • affected 11.0.0 – < 11.0.6-h1
  • affected 10.2.0 – < 10.2.12-h2
  • affected 10.1.0 – < 10.1.14-h6

• Palo Alto Networks · Prisma Access

  • unaffected All

What to do

Solution: This issue is fixed in PAN-OS 10.1.14-h6, PAN-OS 10.2.12-h2, PAN-OS 11.0.6-h1, PAN-OS 11.1.5-h1, PAN-OS 11.2.4-h1, and all later PAN-OS versions. In addition, in an attempt to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases. * Additional PAN-OS 11.2 fixes: * ​​11.2.0-h1 * 11.2.1-h1 * 11.2.2-h2 * 11.2.3-h3 * 11.2.4-h1 * Additional PAN-OS 11.1 fixes: * 11.1.0-h4 * 11.1.1-h2 * 11.1.2-h15 * 11.1.3-h11 * 11.1.4-h7 * 11.1.5-h1 * Additional PAN-OS 11.0 fixes: * 11.0.0-h4 * 11.0.1-h5 * 11.0.2-h5 * 11.0.3-h13 * 11.0.4-h6 * 11.0.5-h2 * 11.0.6-h1 * Additional PAN-OS 10.2 fixes: * 10.2.0-h4 * 10.2.1-h3 * 10.2.2-h6 * 10.2.3-h14 * 10.2.4-h32 * 10.2.5-h9 * 10.2.6-h6 * 10.2.7-h18 * 10.2.8-h15 * 10.2.9-h16 * 10.2.10-h9 * 10.2.11-h6 * 10.2.12-h2 * Additional PAN-OS 10.1 fixes: * 10.1.9-h14 * 10.1.10-h9 * 10.1.11-h10 * 10.1.12-h3 * 10.1.13-h5 * 10.1.14-h6

Workaround: Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you haven’t already, we strongly recommend that you secure access to your management interface according to our best practice deployment guidelines. Specifically, you should restrict access to the management interface to only trusted internal IP addresses to prevent external access from the internet. Review information about how to secure management access to your Palo Alto Networks firewalls: * Palo Alto Networks LIVEcommunity article:  https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Exploitation: Palo Alto Networks observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network.

References (5)

• https://security.paloaltonetworks.com/CVE-2024-9474 (opens in a new tab)vendor-advisory
• https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ (opens in a new tab)
• https://github.com/k4nfr3/CVE-2024-9474 (opens in a new tab)exploit
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474 (opens in a new tab)government-resource
• https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• CISA KEV catalog (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-9474](https://trackcve.app/badge/CVE-2024-9474.svg)](https://trackcve.app/cve/CVE-2024-9474)

Record last updated 4 Aug 2026, 03:55 UTC.