CVE-2024-3400

CVE-2024-3400 is a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software, allowing unauthenticated attackers to execute arbitrary code with root privileges on affected firewalls. This vulnerability specifically impacts certain PAN-OS versions and configurations, while Cloud NGFW, Panorama, and Prisma Access are not affected. With a CVSS score of 10.0, it presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, including in known ransomware campaigns, with publicly available exploit modules and significant community discussion and media coverage highlighting its widespread impact.