CVE-2024-9474PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

6.9 MEDIUMEPSS 93.76%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-08-04 05:16 UTC

OverviewCVSS details

6.9MEDIUMCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Analyzed
Published: Nov 18, 2024
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: Yes · 2 references
CISA KEV: Listed · Nov 18, 2024
KEV due date: Dec 9, 2024
Ransomware use: Known
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

93.76%chance of exploitation in 30 days

Higher than 99.84% of CVEs

CVSS 4.0 · palo_alto (CNA)

6.9Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: None
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

5.9Medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: High
User interaction: None
Confidentiality impact: None
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

7.2High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.9	MEDIUM	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
5.9	MEDIUM	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
7.2	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Dec 9, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Details

CVE ID: CVE-2024-9474
Status: Analyzed
Assigner (CNA): palo_alto
Published: Nov 18, 2024
Last modified: 2026-08-04 05:16 UTC
Weaknesses: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:41 UTC.