Palo Alto Networks—Critical zero-day vulnerability CVE-2024-3400 in Palo Alto firewalls exploited on 6,634 devices, allowing root access
In April 2024, a command injection vulnerability CVE-2024-3400 with CVSS score of 10 allowed unauthenticated attackers to execute arbitrary code with root privileges on Palo Alto Networks firewalls. The vulnerability impacted the GlobalProtect gateway/portal VPN feature on PAN-OS devices. Shadowserver Foundation scanning found 6,634 devices vulnerable and likely exploited. Additional November 2024 vulnerabilities led to about 2,000 firewalls breached worldwide.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| AI Safety | -against | secondary | -0.50 |
| Data Security | -against | primary | -1.00 |
| Overall incident score = | -0.885 | ||
Score = avg(topic contributions) × significance (critical ×2) × confidence (0.59)
Evidence (1 signal)
Palo Alto firewall vulnerability CVE-2024-3400 with CVSS 10 exploited on 6,634 devices allowing root access
In April 2024, a command injection vulnerability CVE-2024-3400 with maximum CVSS score of 10 allowed unauthenticated attackers to execute arbitrary code with root privileges on Palo Alto Networks firewalls. The vulnerability affected GlobalProtect gateway/portal VPN feature. Shadowserver Foundation found 6,634 devices vulnerable and likely exploited.