CVE-2024-9474
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- Record
CVE-2024-9474- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red - CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2024-50354
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- Record
EUVD-2024-50354- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cgvw-jh5j-mgq3
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS...
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- Record
GHSA-cgvw-jh5j-mgq3- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CISA KEV No score
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
- Record
CVE-2024-9474- Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- Record
CVE-2024-9474- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution | 2024-11-18 |
| PoC in GitHub | Chocapikk/CVE-2024-9474 | 2024-11-19 |
| PoC in GitHub | k4nfr3/CVE-2024-9474 | 2024-11-19 |
| PoC in GitHub | deathvu/CVE-2024-9474 | 2024-11-20 |
| PoC in GitHub | coskper-papa/PAN-OS_CVE-2024-9474 | 2024-12-11 |
| PoC in GitHub | aratane/CVE-2024-9474 | 2025-01-16 |
| Nuclei | PAN-OS Management Web Interface - Command Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-9474 is a medium vulnerability (CVSS 6.9) in Palo Alto Networks Cloud Ngfw, published November 18, 2024. CISA lists it as known to be exploited, since November 18, 2024. EUVD reports exploitation since November 18, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.8%, the 99th percentile. No source names a fixed version.
References
security.paloaltonetworks.com/CVE-2024-9474
labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474
github.com/k4nfr3/CVE-2024-9474
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9474
unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474
nvd.nist.gov/vuln/detail/CVE-2024-9474