CVE-2024-9474

What it actually does

CVE-2024-9474 is a PAN-OS management-plane privilege escalation flaw. An attacker who has PAN-OS administrator-level access to the management web interface can cause actions to execute with root privileges on the firewall appliance. In practice, this turns management-interface access into operating-system-level control of the device. The flaw is especially dangerous when chained with an initial-access bug or stolen administrator credentials, because it can let an attacker modify firewall configuration, run commands, access sensitive files, tamper with logs, create persistence, and use the firewall as a foothold into protected networks. Cloud NGFW and Prisma Access are not affected.

Why it matters to the business

Successful exploitation can give an attacker full control of an edge security device that often sits at the boundary of critical networks. Business consequences can include firewall rule tampering, traffic interception, VPN or network disruption, credential and configuration theft, covert persistence on a trusted device, and use of the firewall as a launch point for ransomware or lateral movement. This issue is listed in CISA KEV, has a very high EPSS score, is reported as actively exploited in the wild, and is associated with ransomware use; organizations should treat exposed or unpatched PAN-OS management interfaces as high-priority risk. CISA’s KEV remediation due date was 2024-12-09, so any remaining exposure is overdue.

How an attack unfolds

An attacker first needs access to the PAN-OS management web interface as an administrator. That access may come from legitimate but compromised credentials, an exposed management interface, or chaining with another management-interface vulnerability such as an authentication bypass. After reaching the management web application, the attacker invokes vulnerable functionality that runs privileged management actions but fails to properly constrain execution context. The action is performed with root privileges on the underlying PAN-OS appliance. From there, the attacker can execute commands, alter configuration, create or modify administrator accounts and API keys, collect configuration and secrets, disable or weaken security controls, deploy persistence, and attempt to erase evidence. In real-world campaigns, this class of access is commonly used to establish durable control over the firewall and pivot into internal networks or support ransomware operations.

How to fix it

Upgrade affected PAN-OS firewalls to a vendor-fixed release immediately. Where exact package versions are not provided in the input, use Palo Alto Networks’ current advisory for CVE-2024-9474 and install the fixed release or later for each deployed PAN-OS branch; commonly referenced fixed branches for the November 2024 PAN-OS management-interface issues include PAN-OS 10.2.12-h2 or later, 11.0.6-h1 or later, 11.1.5-h1 or later, and 11.2.4-h1 or later where applicable. If upgrade cannot be completed immediately, restrict management-interface access to trusted administrative networks only, remove internet exposure, enforce VPN or jump-host access, apply management-interface access control lists, disable unused management services, rotate administrator credentials and API keys, and monitor closely for suspicious management activity. Cloud NGFW and Prisma Access are not impacted by this vulnerability, but self-managed PAN-OS appliances should still be inventoried and verified.

How to confirm the fix worked

Confirm the running PAN-OS version on every appliance and compare it against Palo Alto Networks’ fixed-version matrix for the deployed branch. Verify that the management web interface is not exposed to the public internet and is reachable only from approved administrative source networks. Review the configuration for management-interface access controls, permitted IP lists, administrator accounts, API keys, and unexpected policy or system changes. After upgrade, confirm the device reports the corrected PAN-OS release, reboot or fail over according to vendor guidance if required, and re-run external and internal scans to ensure management ports are not reachable from untrusted networks. Validate that no unexpected administrator accounts, API keys, scheduled jobs, support users, modified files, or suspicious configuration commits remain.

Typical attack path

1. Identify PAN-OS firewalls with internet-accessible or otherwise reachable management web interfaces.
2. Obtain management access through stolen administrator credentials, exposed credentials, session theft, or chaining with an authentication-bypass vulnerability.
3. Log in to or establish a session with the PAN-OS management web interface.
4. Trigger the vulnerable management-plane functionality to execute actions with root privileges.
5. Run operating-system-level commands or modify privileged files and configuration.
6. Create persistence such as new administrator users, API keys, scheduled tasks, modified startup scripts, or web-accessible artifacts where possible.
7. Collect configuration, certificates, VPN information, local credentials, traffic policy, and network topology data.
8. Alter firewall rules, NAT, VPN, logging, or security policy to facilitate continued access or lateral movement.
9. Use the firewall as a trusted pivot point into protected networks or as part of ransomware intrusion activity.
10. Tamper with logs or revert visible configuration changes to reduce detection.

How to detect it

Review PAN-OS system, configuration, traffic, threat, authentication, and management-plane logs, as well as any available web server or support-bundle artifacts, for evidence that the management interface was accessed from unusual source IPs or used to perform unexpected privileged actions. Focus on activity before and after patching, especially if the management interface was internet-accessible. Look for successful logins or session creation from unfamiliar addresses, unexplained administrator account creation, API key generation, configuration exports, commits outside change windows, changes to authentication profiles, VPN, NAT, security policy, logging destinations, management access rules, or disabled telemetry. Search for command execution artifacts, unexpected files in management web directories, suspicious root-owned processes, unusual outbound connections initiated by the firewall, and attempts to clear or truncate logs. Because exploitation has been observed in the wild and this issue is commonly chained with initial-access vulnerabilities, also hunt for unauthenticated or abnormal requests to PAN-OS management PHP endpoints, especially from non-administrative networks. If compromise is suspected, collect a support bundle, preserve logs externally, compare configuration to a known-good backup, rotate credentials, and consider rebuilding or factory-resetting the appliance after capturing evidence.

• /php/utils/createRemoteAppwebSession.php
• /var/appweb/htdocs/
• /var/appweb/htdocs/unauth/
• appweb
• mgmtsrvr
• php-fpm
• config export
• Generate API Key
• api keygen
• type=CONFIG
• type=SYSTEM
• cmd=
• request system
• show system info
• debug cli
• admin role
• superuser
• commit by
• websrvr
• /var/log/pan/
• /var/log/pan/system.log
• /var/log/pan/configd.log
• /var/log/pan/mgps.log

What your security team should do

• Immediately inventory all PAN-OS appliances and identify those with management web interfaces reachable from the internet or broad internal networks.
• Patch affected PAN-OS systems to a fixed vendor release or later as an emergency change, prioritizing internet-exposed management interfaces first.
• If patching is delayed, restrict management access to dedicated administrative networks, VPN, or jump hosts and block all untrusted access to management ports.
• Assume exposed and unpatched appliances may be compromised; perform threat hunting and forensic review before declaring remediation complete.
• Review administrator accounts, role assignments, API keys, authentication logs, configuration commits, and recent management actions for unauthorized activity.
• Rotate local administrator passwords, API keys, and any credentials or secrets stored on or used by the firewall if compromise is suspected.
• Export and compare current configuration against a known-good baseline to identify unauthorized policy, NAT, VPN, logging, routing, or authentication changes.
• Preserve logs and support bundles before rebooting or rebuilding systems where exploitation is suspected.
• Monitor for follow-on activity from the firewall toward internal systems, including unusual outbound connections, scanning, authentication attempts, and data transfers.
• Because this is KEV-listed, actively exploited, and associated with ransomware campaigns, track remediation to executive-level closure and document compensating controls for any exceptions.