CVE-2024-0012: CWE-306 Missing Authentication for Critical Function in Palo Alto Networks Cloud NGFW
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
AI Analysis
Technical Summary
This vulnerability (CWE-306) in PAN-OS software enables unauthenticated attackers to bypass authentication on the management web interface, granting them administrator privileges. This can lead to unauthorized administrative actions, configuration tampering, or exploitation of other privilege escalation vulnerabilities such as CVE-2024-9474. The issue affects PAN-OS versions 10.2, 11.0, 11.1, and 11.2 but does not impact Cloud NGFW or Prisma Access services.
Potential Impact
An attacker with network access to the management web interface can gain full administrator privileges without authentication. This compromises the confidentiality, integrity, and availability of the affected system by allowing unauthorized configuration changes and potential further exploitation of related vulnerabilities.
Mitigation Recommendations
No official patch or fix is currently documented. The vendor recommends restricting access to the management web interface to trusted internal IP addresses as a best practice to greatly reduce the risk. Users should follow Palo Alto Networks' deployment guidelines to secure management access. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2024-0012: CWE-306 Missing Authentication for Critical Function in Palo Alto Networks Cloud NGFW
Description
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVSS v4.0
Score 9.3critical
Affected software
pkg:github/paloaltonetworks/pan-osRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-306) in PAN-OS software enables unauthenticated attackers to bypass authentication on the management web interface, granting them administrator privileges. This can lead to unauthorized administrative actions, configuration tampering, or exploitation of other privilege escalation vulnerabilities such as CVE-2024-9474. The issue affects PAN-OS versions 10.2, 11.0, 11.1, and 11.2 but does not impact Cloud NGFW or Prisma Access services.
Potential Impact
An attacker with network access to the management web interface can gain full administrator privileges without authentication. This compromises the confidentiality, integrity, and availability of the affected system by allowing unauthorized configuration changes and potential further exploitation of related vulnerabilities.
Mitigation Recommendations
No official patch or fix is currently documented. The vendor recommends restricting access to the management web interface to trusted internal IP addresses as a best practice to greatly reduce the risk. Users should follow Palo Alto Networks' deployment guidelines to secure management access. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- palo_alto
- Date Reserved
- 2023-11-09T18:56:17.699Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68f7d9af247d717aace2687f
Added to database: 10/21/2025, 19:06:23 UTC
Last enriched: 08/04/2026, 13:17:50 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.