CVE Feed

    Dashboard / CVE / CVE-2024-9474

    CVE-2024-9474

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

    Published:Nov 18, 2024
    Last Modified:Nov 4, 2025
    EPS:Nov 18, 2024
    EPSS Score:0.94174
    CVSS Score:7.2

    CISA Notification

    Description

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

    Required Action:

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.

    Notes:

    No extra notes provided.

    Due Date
    Dec 9, 2024
    641 days ago
    Alert Date
    Nov 18, 2024
    662 days ago

    Affected Products

    Vendor
    Paloaltonetworks
    Product
    Pan-os

    Exploits

    https://github.com/k4nfr3/CVE-2024-9474https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/https://github.com/aratane/CVE-2024-9474https://github.com/Chocapikk/CVE-2024-9474https://github.com/coskper-papa/PAN-OS_CVE-2024-9474https://github.com/deathvu/CVE-2024-9474https://github.com/k4nfr3/CVE-2024-9474

    Related CVEs

    CVE-2026-0301 (CVSS 1.7) — An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software en…
    CVE-2026-0279 (CVSS 1.3) — Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) servi…
    CVE-2026-0280 (CVSS 1.7) — An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an una…
    CVE-2026-0281 (CVSS 2.1) — An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated atta…
    CVE-2026-0282 (CVSS 2.7) — A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with …
    CVE-2026-0283 (CVSS 4.5) — An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS …
    CVE-2026-0284 (CVSS 4.7) — An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® soft…
    CVE-2026-0285 (CVSS 4.7) — A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authentica…
    CVE-2026-0286 (CVSS 6) — A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an au…
    CVE-2026-0287 (CVSS 6.6) — Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated att…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High