Vulnerability Intelligence Report
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Injection
CVSS Base Score
6.9
MEDIUM
EPSS Probability:94.77%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Palo Alto Networks | Cloud NGFW | All (unaffected) |
| Palo Alto Networks | PAN-OS | 11.2.0 < 11.2.4-h1 (affected), 11.1.0 < 11.1.5-h1 (affected), 11.0.0 < 11.0.6-h1 (affected), 10.2.0 < 10.2.12-h2 (affected), 10.1.0 < 10.1.14-h6 (affected) |
| Palo Alto Networks | Prisma Access | All (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
94.766%
GitHub Advisory
Vulnerability Class
Injection
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Palo Alto Networks, Inc. · Vendor · USA |
| Reserved | 2024-10-03T11:35:20 |
| Published | 2024-11-18T15:48:23 |
| Patch Date | 2024-11-18 |
| Last Updated | 2026-08-04T03:55:32 |
Community Chatter & Buzz