Is CVE-2024-0012 actively exploited?

Yes. CVE-2024-0012 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2024-0012 be exploited remotely?

The attack vector of CVE-2024-0012 has not been classified yet.

What is the CVSS score of CVE-2024-0012?

CVE-2024-0012 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2024-0012

HIGHCISA KEVIN THE WILD

CVE-2024-0012

Published: November 18, 2024

EPSS:94.28%probability of exploitation in 30 daysPercentile:99.9th

Official Description

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.

NVD Source

CISA KEV Advisory

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.

Added to KEV: 2024-11-18Federal patch deadline: 2024-12-09⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.

Risk Analysis

This vulnerability in Palo Alto Networks PAN-OS allows an attacker to bypass authentication in the web-based management interface of various PAN-OS products, including firewalls and VPN concentrators. The high EPSS score of 0.94285 and its inclusion in the KEV catalog highlight a significant and urgent risk of exploitation.

This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog, confirming its active use by threat actors.

Recommended Action

It is critical to apply the latest security updates and patches for Palo Alto Networks PAN-OS to mitigate this authentication bypass vulnerability. Additionally, ensure that management interfaces are not exposed to untrusted networks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-0012 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2024-0012 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.