CVE-2024-9474

CVE Enrichment

CVSS: 6.9 MEDIUM
EPSS: 94.82%
EPSS Percentile: 99.86%
CISA KEV: YES — Known Exploited Vulnerability

Description

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: psirt@paloaltonetworks.com
Published: 18-Nov-2024 23:15
Last Modified: 04-Aug-2026 12:16
EPSS Date: 2026-10-16
CWE: CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:H /
                            UI:N /
                            VC:N /
                            VI:H /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:N /
                            R:U /
                            V:C /
                            RE:H /
                            U:Red

CISA KEV Details

Date Added: 2024-11-18
Remediation Due: 2024-12-09
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
Notes: https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474

Affected Products / Versions

paloaltonetworks / pan-os
Version / affected range: * · from (inclusive) 10.1.0 · before (exclusive) 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: * · from (inclusive) 10.2.0 · before (exclusive) 10.2.12
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: * · from (inclusive) 11.0.0 · before (exclusive) 11.0.6
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: * · from (inclusive) 11.1.0 · before (exclusive) 11.1.5
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: * · from (inclusive) 11.2.0 · before (exclusive) 11.2.4
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 10.1.14
cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 10.2.12
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 10.2.12
cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 11.0.6
cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 11.1.5
cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*
paloaltonetworks / pan-os
Version / affected range: 11.2.4
cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*

References

Last enrichment sync: 18-Oct-2026 03:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Following the disclosure of CVE-2024-0012 and CVE-2024-9474 in PAN-OS, Wiz observed attackers deploying web shells and Sliver implants just days after PoCs went public. Wiz Report Highlights Familiar Entry Points in Cloud Attacks
to bypass authentication to the PAN-OS management interface if its publicly exposed. The second, CVE-2024-9474, allows for privilege escalation and ultimately remote code execution. With RCE achieved, threat Wiz Defend Uses Cloud Context to Correlate Threats Across Environments
is an authentication bypass (CVE-2024-0012) and the second is a privilege escalation vulnerability (CVE-2024-9474). Palo Alto PAN-OS Flaws Exploited to Gain Administrator Access

CVE (1)

Malware (6)

Threat Actors (6)

MITRE ATT&CK (8)

Vendors (2)

Products (7)

Tools (3)

Industries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.