Is there a public exploit for CVE-2024-3400?

Yes. CVE-2024-3400 is listed in the CISA Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild.

Is there a proof of concept for CVE-2024-3400?

Yes — 8 proof-of-concept entries are linked on this page, from public repositories and community submissions. They are listed for authorised testing only.

How severe is CVE-2024-3400?

CVE-2024-3400 scores CVSS 10 (v3.1), rated critical. EPSS puts the chance of exploitation in the next 30 days at 100%.

What does CVE-2024-3400 affect?

CVE-2024-3400 affects Palo Alto Networks PAN-OS.

10.0 Critical

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software…

CVE-2024-3400 Exploited

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Being exploited in the wild

Catalogued 12 April 2024 · US federal remediation deadline 19 April 2024 · Known use in ransomware campaigns

Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Exploit code is also public: Metasploit · Exploit-DB · Public PoC · Nuclei template

Metasploitexploit/linux/http/panos_telemetry_cmd_exec
Exploit-DBPalo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation
NucleiGlobalProtect - OS Command Injection
Public PoCh4x0r-dz/CVE-2024-3400162 stars
Public PoCW01fh4cker/CVE-2024-3400-RCE-Scan89 stars
Public PoC0x0d3ad/CVE-2024-340071 stars
Public PoCihebski/CVE-2024-340034 stars
Public PoCChocapikk/CVE-2024-340015 stars
Public PoCmomika233/CVE-2024-340013 stars
Public PoCYuvvi01/CVE-2024-340011 stars
Public PoCak1t4/CVE-2024-34009 stars

Assessment

CVSS: 10 (v3.1)
Severity: Critical
EPSS: 100% chance of exploitation in the next 30 days
Known exploited: Yes — listed in the CISA KEV catalog
Exploit availability: CISA KEV, Metasploit, Exploit-DB, Public PoC, Nuclei template
Published: 12 April 2024
Last updated: 17 June 2026
Affected: Palo Alto Networks · PAN-OS
Weakness: CWE-20, CWE-77
Assigner: psirt@paloaltonetworks.com

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

At the source

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Title *

Proof of concept *

Write-up (optional)

Affected versions (optional)

Name or handle (optional)

References (optional, one URL per line)

Licence for your contribution *

Private contact (optional, never shown)

Before you submit * This vulnerability is already publicly disclosed (it has a published CVE). This material comes only from testing I was authorised to perform. I have the legal right to publish this content and am not breaching any agreement by doing so. It contains no live credentials, personal data, or anything targeting systems I am not authorised to test. I understand it will be reviewed before it appears publicly and may be rejected. I agree to the submission terms.

What is 2 + 4? *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2024-3400