CVE-2024-3400

ENISA EUVD: EUVD-2024-31989 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 5, 2026 14 articles Published: 2024-04-12

EPSS Score

Source: FIRST.org · 2026-05-23
94.32%
probability
This CVE has a 94.32% probability of being exploited in the next 30 days.
0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
10
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

VulnerabilityLookup (CNA)
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Affected Products

Palo Alto Networks
PAN-OS
9.0.0 9.1.0 10.0.0 10.1.0 10.2.0 11.0.0
Palo Alto Networks
Cloud NGFW
All
Palo Alto Networks
Prisma Access
All

Attack Intelligence

Exploits & PoC

h4x0r-dz/CVE-2024-3400

CVE-2024-3400 Palo Alto OS Command Injection

162 2024-04-16
90 2024-04-22
70 2024-04-18
ihebski/CVE-2024-3400

CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

31 2024-04-17
ak1t4/CVE-2024-3400

Global Protec Palo Alto File Write Exploit

9 2024-04-17
AdaniKamal/CVE-2024-3400

CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

7 2024-08-25
zam89/CVE-2024-3400-pot

Simple honeypot for CVE-2024-3400 Palo Alto PAN-OS Command Injection Vulnerability

6 2024-05-26
retkoussa/CVE-2024-3400

CVE-2024-3400 : Palo Alto OS Command Injection - POC

5 2024-04-17
ZephrFish/CVE-2024-3400-Canary

Have we not learnt from HoneyPoC?

2 2025-12-07
swaybs/CVE-2024-3400

Python script to check Palo Alto firewalls for CVE-2024-3400 exploit attempts

2 2024-04-18
HackingLZ/panrapidcheck

Extract useful information from PANOS support file for CVE-2024-3400

2 2025-05-19
marconesler/CVE-2024-3400

Exploit for GlobalProtect CVE-2024-3400

2 2024-04-27
Zedocun/PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Investigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on

1 2026-04-18
MrR0b0t19/CVE-2024-3400

Vulnerabilidad de palo alto

0 2024-04-14
MurrayR0123/CVE-2024-3400-Compromise-Checker

A simple bash script to check for evidence of compromise related to CVE-2024-3400

0 2024-04-26
index2014/CVE-2024-3400-Checker

A check program for CVE-2024-3400, Palo Alto PAN-OS unauthenticated command injection vulnerability. Palo Alto 防火墙 PAN-OS 远程命令注入检测程序。

0 2024-04-17
hahasagined/CVE-2024-3400

EDL for IPs attacking customers with CVE-2024-3400

0 2024-04-18
codeblueprint/CVE-2024-3400

Simple Python code to check for arbitrary uploading for PaloAlto CVE-2024-3400

0 2024-04-19
Ravaan21/CVE-2024-3400

CVE-2024-3400 POC written in Rust and Python

0 2024-04-18
tfrederick74656/cve-2024-3400-poc

Simple POC for CVE-2024-3400

0 2024-04-17
pwnj0hn/CVE-2024-3400

Finding Palo Alto devices vulnerable to CVE-2024-3400.

0 2024-04-19
Kr0ff/cve-2024-3400

Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation

0 2024-04-21
terminalJunki3/CVE-2024-3400-Checker

Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.

0 2024-04-25
workshop748/CVE-2024-3400

Attempt at making the CVE-2024-3400 initial exploit (for educational purposes)

0 2024-11-12
CyprianAtsyor/letsdefend-cve2024-3400-case-study

Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs,

0 2025-04-29
Yafiah-Darwesh/cs50-cyber-paloalto-oauth

CS50 Cybersecurity final project — Palo Alto OAuth token breach (CVE-2024-3400)

0 2025-10-01
GhassanSabir/CVE-2024-3400-poc

CVE-2024-3400的攻击脚本

0 2025-01-10
42 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidence
95%
EPSS 94.32%
CVSS v3.1 10
Mentions 14
Last Seen Feb 25, 2025

CNA Information

CNA Assigner
palo_alto
CNA Title
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Analyst Note

CVE-2024-3400 is explicitly named as a zero-day exploited in the wild to backdoor Palo Alto Networks firewalls, with patch released in April 2024 coinciding with exploitation disclosure. BleepingComputer article title directly states 'zero-day exploited to backdoor firewalls,' and follow-up reporting confirms over 2,000 firewalls were compromised using this vulnerability, establishing active exploitation prior to or concurrent with patch availability.

Threat Actors 66

Lazarus Group
apt_group Information theft and espionage 🇰🇵 KP
APT 41
apt_group Information theft and espionage 🇨🇳 CN
Turla Group
apt_group Information theft and espionage Russian Federation
Void Arachne
apt_group Information theft and espionage 🇨🇳 CN
APT 29
apt_group Information theft and espionage 🇷🇺 RU
DarkHotel
apt_group Information theft and espionage 🇰🇷 KR
Mustang Panda
apt_group Information theft and espionage 🇨🇳 CN
Cobalt
apt_group Financial crime 🇷🇺 RU
FIN7
apt_group Financial crime 🇷🇺 RU
Kimsuky
apt_group Information theft and espionage 🇰🇷 KR
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Vicious Panda
apt_group Information theft and espionage 🇨🇳 CN
TeamPcp
apt_group
Harvester
apt_group Information theft and espionage Unknown
Hacking Team
apt_group 🇮🇹 IT
GhostEmperor
apt_group Information theft and espionage 🇨🇳 CN
NoName057
apt_group 🇷🇺 RU
SCATTERED SPIDER
apt_group Financial crime 🇺🇸 US
Sea Turtle
apt_group Information theft and espionage 🇹🇷 TR
Tick
apt_group Information theft and espionage 🇨🇳 CN
APT3
apt_group Information theft and espionage 🇨🇳 CN
ELECTRUM
apt_group Information theft and espionage 🇷🇺 RU
Infy
apt_group Information theft and espionage 🇮🇷 IR
Just Evil
apt_group 🇷🇺 RU
Volt Typhoon
apt_group Information theft and espionage 🇨🇳 CN
Group 27
apt_group Information theft and espionage 🇨🇳 CN
BRONZE HIGHLAND
apt_group Information theft and espionage 🇨🇳 CN
ArcaneDoor
apt_group 🇨🇳 CN
Silence group
apt_group Financial crime 🇷🇺 RU
Storm-2077
apt_group Information theft and espionage 🇨🇳 CN
Cuboid Sandstorm
apt_group 🇮🇷 IR
Tortoiseshell
apt_group Information theft and espionage 🇮🇷 IR
FamousSparrow
apt_group Information theft and espionage 🇨🇳 CN
RomCom
apt_group Financial gain 🇷🇺 RU
UNC5174
apt_group 🇨🇳 CN
Earth Estries
apt_group Information theft and espionage 🇨🇳 CN
HAFNIUM
apt_group Information theft and espionage 🇨🇳 CN
BrazenBamboo
apt_group 🇨🇳 CN
Fox Kitten
apt_group Information theft and espionage 🇮🇷 IR
Gray Sandstorm
apt_group 🇮🇷 IR
APT 22
apt_group Information theft and espionage 🇨🇳 CN
Actor240524
apt_group
Flax Typhoon
apt_group Information theft and espionage 🇨🇳 CN
Rocke
apt_group 🇨🇳 CN
Void Rabisu
apt_group Financial gain 🇷🇺 RU
UNC4841
apt_group Information theft and espionage 🇨🇳 CN
UTA0218
apt_group 🇨🇳 CN
APT 6
apt_group Information theft and espionage 🇨🇳 CN
Water Bakunawa
apt_group 🇷🇺 RU
Bitwise Spider
apt_group Financial gain 🇷🇺 RU
Red October
apt_group 🇷🇺 RU
Circles
apt_group Global
Operation Red Signature
apt_group Information theft and espionage 🇨🇳 CN
Operation Digital Eye
apt_group Information theft and espionage 🇨🇳 CN
PassCV
apt_group Information theft and espionage 🇨🇳 CN
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Operation Olympic Games
apt_group Sabotage and destruction 🇺🇸 US
Mana Team
apt_group 🇨🇳 CN
Iron Group
apt_group Information theft and espionage 🇨🇳 CN
puNK-003
apt_group 🇰🇵 KP
Operation Shadow Force
apt_group 🇨🇳 CN
TA4903
apt_group 🇺🇸 US
APT 5
apt_group Information theft and espionage 🇨🇳 CN
Beijing Group
apt_group Information theft and espionage 🇨🇳 CN
Operation Black Atlas
apt_group Financial crime
Dark Partners
apt_group

Triage Info

Decided atMar 05, 2026
Published DateApr 12, 2024