# Palo Alto Networks PAN-OS contains authentication bypass (CVE-2024-0012) and privilege…

Published: 2024-11-18 · Severity: critical
Canonical: https://vorant.io/reports/78682dac-31c5-4043-9f58-5a02f299a6d7/palo-alto-networks-pan-os-contains-authentication-bypass-cve-2024-0012-and

> Palo Alto Networks PAN-OS contains authentication bypass (CVE-2024-0012) and privilege escalation (CVE-2024-9474) vulnerabilities in the web management interface, actively exploited in the wild.

Japan's Information-technology Promotion Agency (IPA) has issued a security alert regarding critical vulnerabilities in Palo Alto Networks PAN-OS. The web management interface contains an authentication bypass vulnerability (CVE-2024-0012) and a privilege escalation vulnerability (CVE-2024-9474). Exploitation of these flaws allows unauthenticated remote attackers to gain administrative privileges, modify configurations, and escalate privileges on affected systems.

Palo Alto Networks has confirmed active exploitation of these vulnerabilities in the wild, raising concerns about widespread attacks. The vendor has released patched versions addressing both vulnerabilities. Cloud NGFW and Prisma Access products are not affected by these issues.

Organizations running vulnerable PAN-OS versions are urged to apply patches immediately following vendor guidance. The combination of authentication bypass and privilege escalation provides attackers with a complete compromise path for network security infrastructure, making this a high-priority remediation effort.

## Mentioned in this report

- Vulnerabilities: CVE-2024-0012 (KEV), CVE-2024-9474 (KEV)

## Detection guidance (public sample)

### PAN-OS Management Web Interface Exposed to Untrusted Zone

ATT&CK: T1078

Detects inbound connections to the PAN-OS web management interface (HTTPS management ports) from an untrusted/external zone, indicating the interface is reachable from outside and vulnerable to remote authentication-bypass exploitation (CVE-2024-0012). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PAN-OS Management Interface Reachable From Untrusted Zone
id: 93c6f4e9-5460-53dc-9d28-9f67ce4c6373
status: experimental
description: 'Detects network sessions destined for the PAN-OS web management service
  (typical HTTPS management ports) where the source zone is untrusted or external.

  This exposure pattern is the prerequisite condition abused by CVE-2024-0012 (authentication
  bypass) and CVE-2024-9474 (privilege escalation) to gain unauthenticated administrative
  access to PAN-OS devices.

  '
references:
- https://security.paloaltonetworks.com/CVE-2024-0012
- https://security.paloaltonetworks.com/CVE-2024-9474
author: Vorant
tags:
- attack.t1078
- attack.initial-access
logsource:
  category: firewall
  product: paloalto
detection:
  selection:
    dst_port:
    - 443
    - 4443
    - 8443
    src_zone: untrust
  filter:
    src_zone: trust
  condition: selection and not filter
falsepositives:
- Legitimate administrators or monitoring tools intentionally allowed to reach the
  management interface from an external jump host or VPN-terminated zone that is still
  labeled untrust
- Vulnerability scanners authorized by the organization performing external exposure
  assessments
level: medium
```

### PAN-OS Administrator Account Created or Modified via Web Interface Without Prior Interactive Login

ATT&CK: T1068

Detects PAN-OS configuration log entries that create or modify administrator accounts / roles, which is the post-exploitation action typically performed after successful auth-bypass and privilege-escalation exploitation of the management web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PAN-OS Administrator Account Creation or Privilege Change via Config Log
id: 0acb59b6-daa5-5486-aa75-19b96da45fd2
status: experimental
description: 'Detects configuration change events on PAN-OS devices that add a new
  administrator, change an administrator''s role to superuser/superreader, or reset
  admin credentials through the web management interface.

  This behaviour matches the privilege-escalation step chained after CVE-2024-0012
  (authentication bypass) and CVE-2024-9474 (privilege escalation), where an attacker
  with unauthenticated access creates or elevates an admin account to gain persistent
  administrative control.

  '
references:
- https://security.paloaltonetworks.com/CVE-2024-9474
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
  category: application
  product: paloalto
detection:
  selection:
    subtype: config
    cmd:
    - set
    - edit
    path|contains:
    - mgt-config users
    - shared administrators
    - permissions role-based
  condition: selection
falsepositives:
- Legitimate administrator onboarding or role changes performed by IT staff through
  documented change-management processes
- Automated configuration management tools (e.g., Terraform, Ansible PAN-OS modules)
  provisioning admin accounts
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20241119.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/78682dac-31c5-4043-9f58-5a02f299a6d7/palo-alto-networks-pan-os-contains-authentication-bypass-cve-2024-0012-and.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup