{"id":"CVE-2024-0012","published":"2024-11-18T16:15:11Z","modified":"2026-08-04T05:16:29Z","title":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"description":{"text":"An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like  CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software.\n\nCloud NGFW and Prisma Access are not impacted by this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"Palo Alto Networks PAN-OS has an authentication bypass flaw in its management web interface, affecting PAN-OS 10.2, 11.0, 11.1, and 11.2 software. An unauthenticated attacker with network access to that management interface can gain PAN-OS administrator privileges and so perform administrative actions and tamper with the configuration, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99786,"percentile":0.99956,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-11-18","dueDate":"2024-12-09","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","notes":"https://security.paloaltonetworks.com/CVE-2024-0012 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0012","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-18","exploitedFirstSeen":"2024-11-18","ransomware":true,"evidence":[{"url":"https://security.paloaltonetworks.com/CVE-2024-0012","date":"2024-11-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-19&host_type=src&vulnerability=cve-2024-0012","date":"2024-11-19"},{"url":"https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/","date":"2024-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-20&host_type=src&vulnerability=cve-2024-0012","date":"2024-11-20"},{"url":"https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/","date":"2024-11-20"},{"url":"https://www.fortiguard.com/encyclopedia/ips/56894","date":"2024-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-21&host_type=src&vulnerability=cve-2024-0012","date":"2024-11-21"},{"url":"https://infosec.exchange/@shadowserver/113520322017264871","date":"2024-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-22&host_type=src&vulnerability=cve-2024-0012","date":"2024-11-22"}],"evidenceTotal":686,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2024-0012","tags":["Vendor Advisory"]},{"url":"https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/","tags":["Vendor Advisory"]},{"url":"https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-0012","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-reachable management interface exploited without credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an unauthenticated attacker with network access to the management web interface","start":71,"end":150}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypass yields valid administrator-level access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"to gain PAN-OS administrator privileges to perform administrative actions","start":151,"end":224}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-15815","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-15815","exploited":true,"exploitedSince":"2024-11-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":10,"skipped":0,"earliest":"2024-11-19","earliestUrl":"https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-0012","repos":[{"name":"watchtowrlabs/palo-alto-panos-cve-2024-0012","url":"https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-0012","stars":24,"created":"2024-11-19"},{"name":"Sachinart/CVE-2024-0012-POC","url":"https://github.com/Sachinart/CVE-2024-0012-POC","stars":20,"created":"2024-11-19"},{"name":"TalatumLabs/CVE-2024-0012_CVE-2024-9474_PoC","url":"https://github.com/TalatumLabs/CVE-2024-0012_CVE-2024-9474_PoC","stars":8,"created":"2024-12-11"},{"name":"Regent8SH/PanOsExploitMultitool","url":"https://github.com/Regent8SH/PanOsExploitMultitool","stars":6,"created":"2025-05-21"},{"name":"0xjessie21/CVE-2024-0012","url":"https://github.com/0xjessie21/CVE-2024-0012","stars":4,"created":"2024-11-30"}]},"metasploit":[{"name":"Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution","module":"exploit/linux/http/panos_management_unauth_rce","type":"exploit","disclosureDate":"2024-11-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_management_unauth_rce.rb"}],"nuclei":[{"id":"CVE-2024-0012","name":"PAN-OS Management Web Interface - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-0012.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0012.yaml"}],"first":{"date":"2024-11-18","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_management_unauth_rce.rb"},"provenance":"source"},"exploitRefs":["https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2024-11-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0012","provenance":"source"},{"date":"2024-11-18","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-11-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_management_unauth_rce.rb","provenance":"source"},{"date":"2024-11-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://security.paloaltonetworks.com/CVE-2024-0012","provenance":"source"},{"date":"2024-11-18","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-11-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-15815","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 712 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 10 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}