ZombieMutex / Security research / Technical write-up
CVE-2024-3400 — PAN-OS GlobalProtect command injection
Palo Alto Networks · PAN-OS GlobalProtect · Network
My engineering notes on a third-party disclosed vulnerability. I didn't discover this CVE or test it against a real target. Source-backed facts are distinguished from defensive recommendations and conceptual models.
01 / Description
What happened
A flaw involving arbitrary file creation in specific GlobalProtect configurations of PAN-OS could allow unauthenticated attackers to execute commands with root privileges.
This one matters because it sits at the network edge. A feature intended to bring users into a corporate environment became a possible route to root-level command execution on the gateway itself. The first question isn't whether the organization owns a Palo Alto firewall. It's whether an affected release and a GlobalProtect portal or gateway were actually in use.
The part I'd remember
Version inventory, feature configuration, patch state and compromise investigation are four different checks. Passing one does not answer the others.
02 / Severity
Metrics
CVSS v3.1 base score
10.0 / 10
Severity
Critical
Score source
NVD
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNVD CVSS v3.1 base metric; the vendor also publishes CVSS v4.0. These are different scoring systems and should not be compared as identical metrics.
CISA Known Exploited Vulnerability
This vulnerability appears in CISA's KEV catalog. That is evidence of exploitation in the wild, not proof that a particular installation was attacked.
Check CISA entry| Added to KEV | BOD due date | Required action (summary) |
|---|---|---|
| 2024-04-12 | 2024-04-19 | Apply the vendor mitigations and fixed software; see the current Palo Alto advisory for the exact release and prevention policy. |
03 / Affected scope
Known affected software
Only specific PAN-OS versions with the vulnerable GlobalProtect feature configuration; not all Palo Alto Networks products. A curated, source-attributed overview—not a complete CPE inventory or version classifier.
| Product / branch | Condition / fix | Status |
|---|---|---|
| PAN-OS 10.2 | Affected builds on the 10.2 maintenance branch; vendor lists hotfixes, including 10.2.9-h1. | Conditional |
| PAN-OS 11.0 | Affected builds on the 11.0 maintenance branch; vendor lists hotfixes, including 11.0.4-h1. | Conditional |
| PAN-OS 11.1 | Affected builds on the 11.1 maintenance branch; vendor lists hotfixes, including 11.1.2-h3. | Conditional |
| Required feature | GlobalProtect gateway and/or portal must be configured. Device telemetry does not need to be enabled. | Conditional |
| Cloud NGFW / Prisma Access / Panorama | Vendor identifies these product offerings as not affected. | Not affected |
For the exhaustive affected-software matrices, current hotfixes and CPE strings, use the vendor/CVE/NVD records linked below. An affected product family alone does not establish exposure.
04 / Engineering notes
How I'd think through it
01What crossed the boundary
An unauthenticated request reaches a GlobalProtect-facing service. The weakness links attacker-influenced file creation with command injection, and the resulting command execution can run with the firewall's privileges. That's a much more serious boundary failure than an ordinary application error.
The score is critical, but I wouldn't use the score as an inventory query. PAN-OS alone isn't enough to establish exposure. I need the running maintenance release, hotfix level, relevant GlobalProtect configuration and whether the interface was reachable.
02The evidence I look for first
The first scope decision is which firewall actually runs an affected PAN-OS build and hotfix; a major-version label is not precise enough. I check the GlobalProtect gateway and portal settings against the vendor’s actual affected-version matrix. Customer-managed VM-Series instances can be in scope.
If an appliance was exposed before remediation, updating the firmware is necessary but it doesn't prove the device was never compromised. Palo Alto provides incident-response procedures, indicators and guidance for evidence collection. Preserving available logs and support files matters before remediation steps destroy evidence.
03Mitigation is not the same as a fix
Vendor Threat Prevention signatures can reduce exposure when configured on the correct interfaces, but the vendor recommends upgrading to a fixed PAN-OS build. The applied software version and the enforcement policy are two different facts to verify.
One important correction to early reports: disabling device telemetry is not an effective mitigation. The vendor explicitly withdrew that advice. This is why I link to the current advisory instead of freezing a large configuration table in an article.
05 / Classification
Weakness enumeration
Weakness identifiers describe categories of mistakes, not a step-by-step exploit procedure.
06 / Evidence trail
References and further reading
These links leave ZombieMutex and point to the original vulnerability records, vendor guidance and supporting research. An outbound link is not an endorsement.
| Reference | Source / purpose |
|---|---|
| NVD vulnerability record | NVD |
| Palo Alto Networks advisory | Vendor |
| CISA KEV catalog | CISA |
| Unit 42 threat brief | Vendor research · exploitation context |
| CISA Known Exploited Vulnerabilities | U.S. government · prioritization |
What supports the conclusions
- The vendor acknowledged exploitation in the wild and documented relevant detection and recovery guidance.
- The CISA Known Exploited Vulnerabilities catalog added this entry on April 12, 2024, with a federal remediation due date of April 19, 2024.
- This page does not claim that I reproduced the exploit or assessed a real firewall.
07 / Editorial record
Scope, limitations and review history
- CVE publication
- 2024-04-12
- Editorial snapshot reviewed
- 2026-11-08
- Source score
- NVD · CVSS v3.1
- Research method
- Public-source analysis, not hands-on exploitation
The full NVD CPE matrix contains many version/hotfix combinations and can change. The table here is a scoped summary, not a machine-readable asset-matching oracle. Check the current Palo Alto advisory and NVD/CISA records before deciding an actual device is unaffected.
This is a third-party disclosed CVE explained in my engineering notebook. I don't claim to have discovered it, tested impacted customer systems or received a bug bounty for it. Use current official vendor guidance for security decisions.
Public conversation / GitHub Discussions
Discuss this article
Read and reply using GitHub Discussions. A GitHub account is needed to post. Comments are public and subject to GitHub moderation.
For privacy, the external giscus widget does not load until you choose to open it. Opening it connects your browser to giscus and GitHub. Do not post credentials or private project data.