CVE Watch—

CVE-2024-9474

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CVSS

—

No CVSS

EPSS

94.8%

p100

KEV

YES

Nov 18, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

94.8%EPSS · 30 days94.8%

2026-06-302026-07-16

KEV catalog record

Product

Palo Alto Networks / PAN-OS

Vulnerability

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

Added to KEV

Nov 18, 2024

Remediate by

Dec 9, 2024

Known ransomware use

Yes

Summary description

Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

Notes

https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-3400—

100.0%

KEV—80Palo Alto Networks PAN-OS Command Injection Vulnerability—CVE-2024-0012—

100.0%

KEV—80Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability—CVE-2025-0108—

99.9%

KEV—80Palo Alto Networks PAN-OS Authentication Bypass Vulnerability—CVE-2017-15944—

99.9%

KEV—80Palo Alto Networks PAN-OS Remote Code Execution Vulnerability—CVE-2026-0257—

99.7%

KEV—80Palo Alto Networks PAN-OS Authentication Bypass Vulnerability—CVE-2019-1579—

98.4%

KEV—80Palo Alto Networks PAN-OS Remote Code Execution Vulnerability—