[Update] Vulnerability in Palo Alto Networks GlobalProtect (April 12, 2024)

unknownpublic exploitCVE-2024-3400

[Update on May 10, 2024] CERT-FR intervened to address a ransomware compromise within a French entity. In the context of this attack, the vulnerability was exploited to then lateralize within the victim's information system and...

CSIRTS triage

vendor: Palo Alto Networks product: GlobalProtectOther

What: A vulnerability was exploited in a ransomware attack.
Who is affected: Users of Palo Alto Networks GlobalProtect.
Urgency: Remediation is urgent due to confirmed exploitation in attacks.
Action: Follow the vendor's guidance for securing GlobalProtect.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GlobalProtect

Get an email when a new GlobalProtect advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2024-04-12
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-006/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2024-3400EPSS puts this in the most-targeted tier (100.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-3400	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalexploitedCVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerabilitycisa-kev

Recent advisories for Palo Alto Networks

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] Palo Alto Networks PAN-OS: Multiple vulnerabilitiescert-bund · 2026-07-10
medium[NEW] [medium] Palo Alto Networks Cortex XDR Broker VM: Vulnerability allows privilege escalationcert-bund · 2026-07-10
unknownCVE-2026-0276: A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a loca…nvd · 2026-07-09
unknownCVE-2026-0275: A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a local…nvd · 2026-07-09
unknownCVE-2026-0287: Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unau…nvd · 2026-07-09
unknownCVE-2026-0286: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® softwar…nvd · 2026-07-09