Is CVE-2024-3400 (Palo Alto Networks PAN-OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2024-3400 to its Known Exploited Vulnerabilities catalogue on 12 April 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

What makes this CVE a live exploitation concern?

This is not a theoretical finding. CISA’s inclusion of the issue in KEV is the operational signal that defenders should treat it as actively exploited, not just vulnerable in principle. The important practical question is whether any exposed PAN-OS GlobalProtect endpoint is reachable from the internet and whether it is already being used as an initial access path into the perimeter.

The vulnerability matters because it sits on a high-value edge device, where exploitation can move straight from unauthenticated request to privileged command execution. In practice, that changes the response from routine patch planning to urgent exposure assessment, mitigation, and compromise checking.

For broader context on exposed appliances, management-plane hardening, logging, and end-of-life edge device handling, see the Edge Device Security Guide.

How to confirm exposure and judge urgency

Start by confirming whether any PAN-OS firewall in scope exposes the affected GlobalProtect-facing function to the internet. If you have multiple sites, treat externally reachable appliances as the highest-priority population, then work inward to remote-access gateways, partner-connected firewalls, and lab or test systems that mirror production.

Use your vulnerability management workflow to verify asset inventory, identify which systems need emergency triage, and distinguish confirmed exposure from generic vendor presence. On internet-facing devices, this is one of the cases where exploitability and business criticality matter more than a simple software list.

Use the Zero-Day and Exploited Vulnerabilities Guide to align triage with KEV-driven response, and the Vulnerability Management Guide to prioritise asset scope, exception handling, and remediation tracking.

Check the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative patch and mitigation instructions rather than relying on summaries or secondary posts.

What to do if patching is delayed, and what to check after exposure

If you cannot patch immediately, treat mitigation as temporary risk reduction, not closure. Reduce reachability, restrict management access, review any exposed GlobalProtect entry point, and preserve logs before making changes so you can investigate whether exploitation occurred before the window was closed.

Because the issue allows command execution with root privileges, assume the firewall itself may have been used as the foothold. Hunt for unusual processes, unexpected config changes, suspicious outbound traffic, and evidence of post-exploitation activity on or through the appliance. If the device mediated authentication or remote access, also review whether credentials or sessions associated with that path should be rotated or invalidated.

For a practical model of what exploited perimeter devices can expose and why credential and session review matters after compromise, compare this case with the Ivanti Connect Secure exploitation 2024 incident.

Risk and Threat Considerations

Internet-facing appliance flaws are attractive because they compress the attack path: a single unauthenticated request can become durable foothold, privilege escalation, or a pivot into internal systems. When the vulnerable component is a firewall or remote-access gateway, the defender’s biggest risk is not just service outage, but silent trust-boundary collapse.

Failure mechanism: The attacker sends crafted input to the GlobalProtect feature, triggers command injection, and runs commands as root on the firewall. From there, the device can be used for reconnaissance, credential theft, traffic interception, configuration tampering, or staging further access inside the environment.

Impact: Expect perimeter compromise, possible exposure of internal access paths, and a higher chance that the appliance must be treated as both a patching priority and a forensics target. If the firewall handled remote access or administrative flows, downstream identity and session material may also need review.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited edge flaws require rapid exposure triage and remediation prioritization.
	CIS-12 — Network Infrastructure Management	Firewall compromise directly concerns secure configuration and control of network infrastructure.
Recommendation — Prioritise internet-facing PAN-OS devices for immediate remediation and exception handling. Harden and monitor perimeter appliances, especially management and remote-access surfaces.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A KEV-listed command-injection flaw requires timely remediation and mitigation tracking.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation checking depends on reviewing appliance and adjacent logs for abuse evidence.
Recommendation — Remediate the vulnerability promptly and document any compensating controls until patching is complete. Review firewall and access logs for signs of command execution and follow-on activity.
OWASP ASVS	V15 — Secure Architecture	Command injection on a security gateway is an architecture and trust-boundary failure.
Recommendation — Treat exposed command-execution paths on gateway components as high-severity architectural defects.

Practitioner Guidance

What to verify: Confirm whether every internet-reachable PAN-OS GlobalProtect instance is covered by emergency mitigation, patched per vendor guidance, and monitored for signs of exploitation before you consider the issue contained.

Decision rule: If the appliance was externally reachable while unpatched, investigate for compromise first and restoration second; if the system cannot be trusted, rotate any credentials, sessions, or secrets that may have traversed it before resuming normal access.

Practitioner takeaway: KEV listing should change the response posture immediately, because on an edge firewall the question is not only whether the bug exists, but whether the perimeter itself has already been used as the breach point.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org