Palo Alto Networks PAN-OS contains authentication bypass (CVE-2024-0012) and privilege…
Palo Alto Networks PAN-OS contains authentication bypass (CVE-2024-0012) and privilege escalation (CVE-2024-9474) vulnerabilities in the web management interface, actively exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) has issued a security alert regarding critical vulnerabilities in Palo Alto Networks PAN-OS. The web management interface contains an authentication bypass vulnerability (CVE-2024-0012) and a privilege escalation vulnerability (CVE-2024-9474). Exploitation of these flaws allows unauthenticated remote attackers to gain administrative privileges, modify configurations, and escalate privileges on affected systems.
Palo Alto Networks has confirmed active exploitation of these vulnerabilities in the wild, raising concerns about widespread attacks. The vendor has released patched versions addressing both vulnerabilities. Cloud NGFW and Prisma Access products are not affected by these issues.
Organizations running vulnerable PAN-OS versions are urged to apply patches immediately following vendor guidance. The combination of authentication bypass and privilege escalation provides attackers with a complete compromise path for network security infrastructure, making this a high-priority remediation effort.
Mentioned in this report
Detection guidance
PAN-OS Management Web Interface Exposed to Untrusted Zone
Detects inbound connections to the PAN-OS web management interface (HTTPS management ports) from an untrusted/external zone, indicating the interface is reachable from outside and vulnerable to remote authentication-bypass exploitation (CVE-2024-0012). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PAN-OS Management Interface Reachable From Untrusted Zone
id: 93c6f4e9-5460-53dc-9d28-9f67ce4c6373
status: experimental
description: 'Detects network sessions destined for the PAN-OS web management service
(typical HTTPS management ports) where the source zone is untrusted or external.
This exposure pattern is the prerequisite condition abused by CVE-2024-0012 (authentication
bypass) and CVE-2024-9474 (privilege escalation) to gain unauthenticated administrative
access to PAN-OS devices.
'
references:
- https://security.paloaltonetworks.com/CVE-2024-0012
- https://security.paloaltonetworks.com/CVE-2024-9474
author: Vorant
tags:
- attack.t1078
- attack.initial-access
logsource:
category: firewall
product: paloalto
detection:
selection:
dst_port:
- 443
- 4443
- 8443
src_zone: untrust
filter:
src_zone: trust
condition: selection and not filter
falsepositives:
- Legitimate administrators or monitoring tools intentionally allowed to reach the
management interface from an external jump host or VPN-terminated zone that is still
labeled untrust
- Vulnerability scanners authorized by the organization performing external exposure
assessments
level: medium
PAN-OS Administrator Account Created or Modified via Web Interface Without Prior Interactive Login
Detects PAN-OS configuration log entries that create or modify administrator accounts / roles, which is the post-exploitation action typically performed after successful auth-bypass and privilege-escalation exploitation of the management web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PAN-OS Administrator Account Creation or Privilege Change via Config Log
id: 0acb59b6-daa5-5486-aa75-19b96da45fd2
status: experimental
description: 'Detects configuration change events on PAN-OS devices that add a new
administrator, change an administrator''s role to superuser/superreader, or reset
admin credentials through the web management interface.
This behaviour matches the privilege-escalation step chained after CVE-2024-0012
(authentication bypass) and CVE-2024-9474 (privilege escalation), where an attacker
with unauthenticated access creates or elevates an admin account to gain persistent
administrative control.
'
references:
- https://security.paloaltonetworks.com/CVE-2024-9474
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
category: application
product: paloalto
detection:
selection:
subtype: config
cmd:
- set
- edit
path|contains:
- mgt-config users
- shared administrators
- permissions role-based
condition: selection
falsepositives:
- Legitimate administrator onboarding or role changes performed by IT staff through
documented change-management processes
- Automated configuration management tools (e.g., Terraform, Ansible PAN-OS modules)
provisioning admin accounts
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20241119.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free