Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2024-04-12

CVE-2024-3400

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

  1. KEV
  2. 94 days →First PoC
  3. 781 days →Metasploit
  4. 136 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2024-04-12 · due 2024-04-19 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

47 known · links only

GitHub PoCs · by trust, then stars44

  1. h4x0r-dz/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400 Palo Alto OS Command Injection

    ★ 162 · created 2024-04-16

  2. W01fh4cker/CVE-2024-3400-RCE-Scan ↗Trust ok 100

    CVE-2024-3400-RCE

    ★ 90 · created 2024-04-16

  3. 0x0d3ad/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400

    ★ 71 · created 2024-04-13

  4. ihebski/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

    ★ 34 · created 2024-04-16

  5. Chocapikk/CVE-2024-3400 ↗Trust ok 100

    ★ 15 · created 2024-04-16

  6. momika233/CVE-2024-3400 ↗Trust ok 100

    ★ 13 · created 2024-04-14

  7. Yuvvi01/CVE-2024-3400 ↗Trust ok 100

    ★ 11 · created 2024-04-13

  8. ak1t4/CVE-2024-3400 ↗Trust ok 100

    Global Protec Palo Alto File Write Exploit

    ★ 9 · created 2024-04-17

  9. AdaniKamal/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

    ★ 8 · created 2024-04-16

  10. 0xr2r/CVE-2024-3400-Palo-Alto-OS-Command-Injection ↗Trust ok 100

    ★ 6 · created 2024-04-25

  11. zam89/CVE-2024-3400-pot ↗Trust ok 100

    Simple honeypot for CVE-2024-3400 Palo Alto PAN-OS Command Injection Vulnerability

    ★ 6 · created 2024-04-24

  12. retkoussa/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400 : Palo Alto OS Command Injection - POC

    ★ 5 · created 2024-04-17

  13. schooldropout1337/CVE-2024-3400 ↗Trust ok 100

    ★ 5 · created 2024-04-18

  14. CerTusHack/CVE-2024-3400-PoC ↗Trust ok 100

    ★ 2 · created 2024-04-13

  15. CONDITIONBLACK/CVE-2024-3400-POC ↗Trust ok 100

    ★ 2 · created 2024-04-16

  16. HackingLZ/panrapidcheck ↗Trust ok 100

    Extract useful information from PANOS support file for CVE-2024-3400

    ★ 2 · created 2024-04-19

  17. marconesler/CVE-2024-3400 ↗Trust ok 100

    Exploit for GlobalProtect CVE-2024-3400

    ★ 2 · created 2024-04-27

  18. swaybs/CVE-2024-3400 ↗Trust ok 100

    Python script to check Palo Alto firewalls for CVE-2024-3400 exploit attempts

    ★ 2 · created 2024-04-18

  19. ZephrFish/CVE-2024-3400-Canary ↗Trust ok 100

    Have we not learnt from HoneyPoC?

    ★ 2 · created 2024-04-17

  20. hashdr1ft/SOC274-Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400 ↗Trust ok 100

    ★ 1 · created 2025-02-02

  21. wa6n3r/CVE-2024-3400 ↗Trust ok 100

    ★ 1 · created 2026-04-20

  22. Zedocun/PAN-OS-CVE-2024-3400-Command-Injection-Investigation ↗Trust ok 100

    Investigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on log evidence.

    ★ 1 · created 2026-04-16

  23. andrelia-hacks/CVE-2024-3400 ↗Trust ok 100

    ★ 0 · created 2024-05-12

  24. codeblueprint/CVE-2024-3400 ↗Trust ok 100

    Simple Python code to check for arbitrary uploading for PaloAlto CVE-2024-3400

    ★ 0 · created 2024-04-18

  25. CyberBibs/SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400- ↗Trust ok 100

    ★ 0 · created 2025-06-08

  26. CyprianAtsyor/letsdefend-cve2024-3400-case-study ↗Trust ok 100

    Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs, exploit patterns, and mitigation guidance.

    ★ 0 · created 2025-04-29

  27. FoxyProxys/CVE-2024-3400 ↗Trust ok 100

    ★ 0 · created 2024-04-13

  28. GhassanSabir/CVE-2024-3400-poc ↗Trust ok 100

    CVE-2024-3400的攻击脚本

    ★ 0 · created 2025-12-05

  29. hahasagined/CVE-2024-3400 ↗Trust ok 100

    EDL for IPs attacking customers with CVE-2024-3400

    ★ 0 · created 2024-04-18

  30. index2014/CVE-2024-3400-Checker ↗Trust ok 100

    A check program for CVE-2024-3400, Palo Alto PAN-OS unauthenticated command injection vulnerability. Palo Alto 防火墙 PAN-OS 远程命令注入检测程序。

    ★ 0 · created 2024-04-17

  31. ivan-n0v/cve-2024-3400 ↗Trust ok 100

    ★ 0 · created 2024-05-19

  32. Kr0ff/cve-2024-3400 ↗Trust ok 100

    Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation

    ★ 0 · created 2024-04-21

  33. LoanVitor/CVE-2024-3400- ↗Trust ok 100

    ★ 0 · created 2024-04-16

  34. MrR0b0t19/CVE-2024-3400 ↗Trust ok 100

    Vulnerabilidad de palo alto

    ★ 0 · created 2024-04-14

  35. MurrayR0123/CVE-2024-3400-Compromise-Checker ↗Trust ok 100

    A simple bash script to check for evidence of compromise related to CVE-2024-3400

    ★ 0 · created 2024-04-15

  36. P4rC3L/Global-Protect_VPN_Vuln ↗Trust ok 100

    Testing a List of IP address incase they are vulnerable to CVE-2024-3400

    ★ 0 · created 2026-05-30

  37. pwnj0hn/CVE-2024-3400 ↗Trust ok 100

    Finding Palo Alto devices vulnerable to CVE-2024-3400.

    ★ 0 · created 2024-04-19

  38. Ravaan21/CVE-2024-3400 ↗Trust ok 100

    CVE-2024-3400 POC written in Rust and Python

    ★ 0 · created 2024-04-18

  39. razureink/cve-2024-3400-panos_rce_reproduction ↗Trust ok 100

    Reproduction of cve-2024-3400-panos_rce_reproduction

    ★ 0 · created 2026-07-24

  40. sxyrxyy/CVE-2024-3400-Check ↗Trust ok 100

    ★ 0 · created 2024-04-18

  41. terminalJunki3/CVE-2024-3400-Checker ↗Trust ok 100

    Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.

    ★ 0 · created 2024-04-24

  42. tfrederick74656/cve-2024-3400-poc ↗Trust ok 100

    Simple POC for CVE-2024-3400

    ★ 0 · created 2024-04-18

  43. workshop748/CVE-2024-3400 ↗Trust ok 100

    Attempt at making the CVE-2024-3400 initial exploit (for educational purposes)

    ★ 0 · created 2024-11-12

  44. Yafiah-Darwesh/cs50-cyber-paloalto-oauth ↗Trust ok 100

    CS50 Cybersecurity final project — Palo Alto OAuth token breach (CVE-2024-3400)

    ★ 0 · created 2025-10-01

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution ↗

    This module exploits two vulnerabilities in Palo Alto Networks PAN-OS that allow an unauthenticated attacker to create arbitrarily named files and execute shell commands. Configuration requirements are PAN-OS with GlobalProtect Gateway or GlobalProtect Portal enabled and telemetry collection on (default). Affected versions include < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1, < 10.2.5-h6, < 10.2.6-h3, < 10.2.8-h3,

    ruby · seen 2026-10-18

Exploit-DB1

  1. Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation ↗

    created 2024-04-21

Nuclei1

  1. GlobalProtect - OS Command Injection ↗

    A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.