CVE-2024-9474

CVE-2024-9474 is an OS command injection flaw (CWE-78) in the Palo Alto Networks PAN-OS management web interface that allows a PAN-OS administrator to perform actions on the firewall with root privileges. It is triggered by an authenticated administrator through the management interface, and it becomes far more serious when chained with the separately disclosed CVE-2024-0012 management-interface authentication bypass, which hands unauthenticated attackers initial access before they escalate to root. A successful attacker gains root-level control of the device, enough to alter configurations, harvest credentials, and pivot into connected networks. Only PAN-OS deployments are affected — Palo Alto Networks states Cloud NGFW and Prisma Access are not impacted. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-11-18 with known ransomware use, reporting describes over 2,000 PAN-OS devices compromised in an ongoing campaign, and public PoC/exploit code is available.

What to do: Upgrade affected PAN-OS systems to the patched releases identified in the Palo Alto Networks security advisory, and also remediate CVE-2024-0012, which attackers are chaining with this flaw. Until patched, ensure the management interface is not exposed to untrusted networks including the internet, per CISA's required action. Because successful attackers obtain root access, review management and configuration audit logs for unexpected activity and rotate management credentials on any device showing signs of compromise.