DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS management interface auth bypass chained with privilege escalation (Operation Lunar Peek)

CVE-2024-0012, CVE-2024-9474Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 18 Nov 2024

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 10 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
10d
First public report to first fix
Follow-through
10d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Palo Alto Networks advisory CVE-2024-0012 (advisory page timeline)CuratedQuote verified

    2024-11-08 Initially published as PAN-SA-2024-0015

    PAN's own informational bulletin about a claimed management-interface RCE is the first public signal found. Time from this timeline entry's data-date attribute (2024-11-08T13:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:83d359eaff9a7e03…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Palo Alto Networks advisory CVE-2024-0012 (advisory page timeline)CuratedQuote verified14 Nov 2024, 22:18 UTC

    2024-11-14 Raised the severity of PAN-SA-2024-0015 bulletin as we have observed threat activity

    First public report of exploitation; the earlier world candidate is the bulletin about the unverified claim. Time from this timeline entry's data-date attribute (2024-11-14T22:18:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:83d359eaff9a7e03…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-0012)ClaimedQuote verified18 Nov 2024

    Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2024-11-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-9474)ClaimedQuote verified18 Nov 2024

    Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2024-11-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2024-9474ClaimedQuote verified18 Nov 2024, 14:20 UTC

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b78316180f31818c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet18 Nov 2024, 14:51 UTC

    https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-0012ClaimedQuote verified18 Nov 2024, 15:47 UTC

    administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ead20f123294f876…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet19 Nov 2024, 13:37 UTC

    Pots and Pans, a.k.a. an Sslvpn Palo Alto Pan-OS CVE-2024-0012 and CVE-2024-9474

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet19 Nov 2024, 14:28 UTC

    Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 # CVE_2024_0012 # CVE_2024_9474 https:// labs.watchtowr.com/pots-and-pa ns-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Palo Alto Networks advisory CVE-2024-0012 (advisory page timeline)CuratedQuote verified

    2024-11-08 Initially published as PAN-SA-2024-0015

    Time from this timeline entry's data-date attribute (2024-11-08T13:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:83d359eaff9a7e03…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2024-9474ClaimedQuote verified18 Nov 2024, 14:20 UTC

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b78316180f31818c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Palo Alto Networks bulletin PAN-SA-2024-0015 (Wayback snapshot 2024-11-11 08:38 UTC)CuratedQuote verified

    In particular, we recommend that you ensure that access to the management interface is possible only from trusted internal IPs and not from the Internet.

    Bulletin shows 'Published 2024-11-08'; earliest capture is from 2024-11-11 (bulletin updated 2024-11-11).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:17bca88a35f00004…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    +10d

    Palo Alto Networks advisory CVE-2024-9474 (advisory page timeline)CuratedQuote verified

    2024-11-18 Initial publication

    Fixed releases published with this advisory. Time from this timeline entry's data-date attribute (2024-11-18T14:00:00.000Z) on the same page. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dddb0806cdf9af8b…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2024-0012 (advisory page timeline)CuratedQuote verified18 Nov 2024, 14:20 UTC

    2024-11-18 CVE-2024-0012 assigned to this publication as the vulnerability is identified and fixed

    CVE-2024-9474's advisory was published at 2024-11-18T14:00Z with fixes. The 2024-11-18 15:23Z capture of the CVE-2024-0012 page lists 11.2.4-h1, 11.1.5-h1, 11.0.6-h1 and 10.2.12-h2 with no ETAs. Time from this timeline entry's data-date attribute (2024-11-18T14:20:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:83d359eaff9a7e03…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +10d

    Palo Alto Networks advisory CVE-2024-0012 (Wayback snapshot 2024-11-18 15:23 UTC)CuratedQuote verified

    See the Solution section for additional fixes to commonly deployed maintenance releases.

    Every affected train (11.2, 11.1, 11.0, 10.2) had a fix in the first capture after the fix announcement; product status: 'PAN-OS 11.2 < 11.2.4-h1 >= 11.2.4-h1 ... PAN-OS 10.2 < 10.2.12-h2 >= 10.2.12-h2'. The product status table was updated again on 2025-03-03.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a7dcf7304233228a…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2024-0012

    Recorded in the revision history

    Palo Alto Networks Security Advisories /

    Version table: 2 rows added and 2 rows removed. One new row reads "PAN-OS 11.2 | = 11.2.0-h1 >= 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1".

    • Fixed versions
    Version table rows
    BeforePAN-OS 11.2 | = 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1; PAN-OS 10.2 | = 10.2.0-h4 >= 10.2.1-h3 >= 10.2.2-h6 >= 10.2.3-h14 >= 10.2.4-h32 >= 10.2.5-h9 >= 10.2.6-h6 >= 10.2.7-h18 >= 10.2.8-h15 >= 10.2.9-h16 >= 10.2.10-h9 >= 10.2.11-h6 >= 10.2.12-h2 >= 10.2.12-h2
    AfterPAN-OS 11.2 | = 11.2.0-h1 >= 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1; PAN-OS 10.2 | = 10.2.0-h4 >= 10.2.1-h3 >= 10.2.2-h6 >= 10.2.3-h14 >= 10.2.4-h32 >= 10.2.5-h9 >= 10.2.6-h6 >= 10.2.7-h18 >= 10.2.8-h15 >= 10.2.9-h16 >= 10.2.10-h9 >= 10.2.11-h6 >= 10.2.12-h2
    Earlier version captured 4 Feb 2025, 13:56 UTC: archived copyLater version captured 17 Sep 2026, 06:15 UTC: archived copyRecovered from archived copiesSnapshots 7b9b0d24ce… and 83d359eaff…Incident page

  2. PAN-SA-2024-0015

    Recorded in the revision history

    Palo Alto Networks Security Advisories /

    CVSS base vector changed from AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L to AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N. Published date changed from 2024-11-08 to 2024-11-18.

    • Severity
    • Dates
    CVSS vector
    BeforeAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
    AfterAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N
    Published date
    Before2024-11-08
    After2024-11-18
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    ur scan did not find any devices with internet-facing management interface for your account.​​ Severity: CRITICAL CVSSv4.0 Base Score: 9.3 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/R:U/V:C/RE:M/U:Red ) Exploitation Status Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of

    After

    ighest when you allow access to the management interface from external IP addresses on the internet. CRITICAL - CVSS-BT: 9.3 / CVSS-B: 9.3 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:H/U:Red ) If you configure restricted access to a jump box that is the only system allowed to access the management interface, you greatly reduce the risk of exploitation beca

    Earlier version captured 18 Nov 2024, 14:17 UTC: archived copyLater version captured 9 Jul 2026, 20:14 UTC: archived copyRecovered from archived copiesSnapshots 2ea2a6a11b… and faca9054ea…Incident page

Send this to your boss

Palo Alto firewall management interfaces hit by zero-day chain; fixed Nov 18

Attackers chained two PAN-OS flaws to take over firewalls whose management interface faced the internet, before Palo Alto Networks released fixes on 18 November 2024.

In plain words

Palo Alto Networks firewalls had two flaws that, combined, let attackers take full control of a firewall through its management web page, and attackers used them before a fix existed. The vendor warned customers on 8 November 2024 and released fixes on 18 November. If we use these firewalls, they must be on the fixed versions and their management pages must not be reachable from the internet.

What happened and who is affected

What happened

On 8 November 2024 Palo Alto Networks warned of an unverified claim of a remote code execution flaw in the PAN-OS management interface and urged customers to restrict access. On 14 November it reported observed attacks, and on 18 November it published CVE-2024-0012 (authentication bypass) and CVE-2024-9474 (privilege escalation to root) with fixed releases. Exploitation spread quickly after technical details became public, and CISA marks the bugs as used in ransomware campaigns.

Who is affected

PAN-OS 11.2 before 11.2.4-h1, 11.1 before 11.1.5-h1, 11.0 before 11.0.6-h1 and 10.2 before 10.2.12-h2 (CVE-2024-0012; CVE-2024-9474 also affects 10.1) on PA-Series, VM-Series and CN-Series firewalls and Panorama, when the management web interface is exposed.

CVE-2024-0012, CVE-2024-9474. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/palo-alto-networks-cve-2024-0012/

Affected products

  • PAN-OS (PA-Series, VM-Series, CN-Series firewalls, Panorama, WildFire appliances)
How we built this timeline

Grouping: CVE-2024-0012 and CVE-2024-9474 were exploited together (PAN Unit 42 'Operation Lunar Peek'); both KEV 18 Nov 2024, ransomware use Known. Timeline (CVE-2024-0012 advisory page, data-date times): 8 Nov 2024 PAN-SA-2024-0015 informational bulletin (no CVE, no fix; 'We have not seen any signs of exploitation' as of the 11 Nov 2024 capture); 14 Nov 2024 severity raised after observed threat activity; 18 Nov 2024 CVE assigned and fixed.

The 15 Nov 2024 capture says 'Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet.' CVSS-B 9.3 for CVE-2024-0012 (6.9 for CVE-2024-9474). Unit 42 threat brief: 'Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474' (https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/).

Related

Palo Alto Networks report card