CVE coverage
View on NVD →
CVE-2024-3400
CVSS 10.0
Actively exploited (KEV)
6 detections found
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Python Path File (pth) Creation | production | 2026-09-18 |
| sigma | Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection | test | 2025-11-22 |
| sigma | Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation | test | 2024-04-25 |
| sigma | Python Path Configuration File Creation - Linux | test | 2024-04-25 |
| sigma | Python Path Configuration File Creation - MacOS | test | 2024-04-25 |
| sigma | Python Path Configuration File Creation - Windows | test | 2024-04-25 |