PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)CVE-2024-0012

Why this deserves its current priority

CVSS is 9.3. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Palo Alto Networks/PAN-OS (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Palo Alto Networks/PAN-OS.
2. 2Review the reported fix. Source-reported workaround: Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you haven’t already, we strongly recommend that you secure access to your management interface according to our best practice deployment guidelines. Specifically, you should restrict access to the management interface to only trusted internal IP addresses to prevent external access from the internet. Additionally, if you have a Threat Prevention subscription, you can block these attacks using Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763 (available in Applications and Threats content version 8915-9075 and later). For these Threat IDs to protect against attacks for this vulnerability, * Ensure that all the listed Threat IDs are set to block mode, * Route incoming traffic for the MGT port through a DP port https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba , e.g., enabling management profile on a DP interface for management access, * Replace the Certificate for Inbound Traffic Management https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c , * Decrypt inbound traffic to the management interface so the firewall can inspect it https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2 , and * Enable threat prevention on the inbound traffic to management services. Review information about how to secure management access to your Palo Alto Networks firewalls: * Palo Alto Networks LIVEcommunity article:  https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and more detailed technical documentation:  https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Evidence timeline and material changes

1. Published upstream

   Nov 18, 2024

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 4, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Nov 18, 2024

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencelabs.watchtowr.com
• Source referencesecurity.paloaltonetworks.com
• Source referenceunit42.paloaltonetworks.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET RequestsAlso CWE-306
• Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbAlso CWE-306
• WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootAlso CWE-306