In April 2024, Palo Alto Networks disclosed CVE-2024-3400, a command injection vulnerability in PAN-OS GlobalProtect [1]. CISA concurrently issued an alert noting active exploitation in the wild and requiring agencies to remediate the flaw promptly in accordance with vendor guidance [2]. Authorities recommend immediately applying patches or workarounds and inspecting systems for signs of compromise [3].
Backfill: this event became public on Apr 12, 2024 and we added it on Nov 8, 2026. It is not a new event.
Actively Exploited Command Injection Vulnerability CVE-2024-3400 Disclosed in Palo Alto Networks PAN-OS GlobalProtect
1 min read
- Disclosed
- Apr 12, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- 100%, higher than 100% of CVEs
- Exploitation and patch status
- Exploited
- Attack vector
- Vulnerability status
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Organisations running: Palo Alto Networks PAN-OS GlobalProtect gateway
What to do nowOur advice
Authorities recommend immediately applying patches or workarounds and inspecting systems for signs of compromise [3].
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Palo Alto Networks PAN-OS GlobalProtect gateway | 見廠商安全公告所列受影響版本[1] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Source-Supported Details
Specific versions of PAN-OS with GlobalProtect gateway enabled are affected. Update in accordance with the vendor security advisory and perform detection and incident response following CISA guidance [1].
Source excerpt for verification: "You can verify whether you have a GlobalProtect gateway or GlobalProtect portal configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals)." [1].
Source excerpt for verification: "Palo Alto Networks has released workaround guidance for a command injection vulnerability (CVE-2024-3400) affecting PAN-OS versions 10.2, 11.0, and 11.1. Palo Alto Networks has reported active exploitation of this vulnerability in the wild." [2].
References
Official / primary3
- [1]
“You can verify whether you have a GlobalProtect gateway or GlobalProtect portal configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals).”
- [2]
Corrections
- · countries: 攻擊來源：美國 → 原本把美國標成攻擊來源，但來源沒有指出攻擊者來自美國或受其支持，因此移除。
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.