CVE-2024-0012
A security flaw in Palo Alto Networks PAN-OS software allows an attacker to bypass authentication entirely. This means someone can gain administrative access to the system without needing a username or password.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running PAN-OS versions 10.2, 11.0, 11.1, and 11.2. Cloud NGFW and Prisma Access are not affected.
Real-world impact
An attacker could gain full administrator privileges to perform administrative actions, change system configurations, or use this access to exploit other vulnerabilities to escalate their privileges further.
Why this severity
This vulnerability is rated as critical because it allows an unauthenticated attacker to gain full administrative control over the device via the network.
What to do about it
- 01Apply mitigations per vendor instructions.
- 02Ensure the management interface for affected devices is not exposed to untrusted networks, including the internet.
- ›Restrict access to the management web interface to only trusted internal IP addresses.
CISA KEV required action
Timeline
- Nov 18, 2024 · Nov 18, 2024Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Nov 18, 2024 · Nov 18, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Dec 9, 2024 · Dec 9, 2024CISA remediation deadlineFederal agencies are required to remediate by this date.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- security.paloaltonetworks.com/CVE-2024-0012vendor advisory
- unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474…vendor advisory
- labs.watchtowr.com/pots-and-pans-aka-an-sslvpn…exploitthird party advisory
- cisa.gov/known-exploited-vulnerabili…us government resource