# CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

- Exploited (CISA KEV): yes, added 2024-11-18, known ransomware use
- Published: 2024-11-18
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: 99.8% (100th percentile)
- CWE: CWE-306

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like  CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-01-06 | 49 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-01-21 | 64 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-01-06 · new · rule 1fe510368b4a47dda90363c2ecdf3d02 · default Block
  > Palo Alto Networks - Remote Code Execution - CVE:CVE-2024-0012, CVE:CVE-2024-9474. Previous action: Log. New action: Block. New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-01-06-waf-release/

### F5

- 2025-01-21 · new · rule 200013102
  > Added: signature 200013102 "Palo Alto PAN-OS Management Web Authentication Bypass (1)" (Authentication/Authorization Attacks, risk High), systems: PHP, Other Web Server, Proxy Servers. References: CVE-2024-0012, CVE-2024-9474.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-01-21 · new · rule 200013103
  > Added: signature 200013103 "Palo Alto PAN-OS Management Web Authentication Bypass (2)" (Authentication/Authorization Attacks, risk High), systems: PHP, Other Web Server, Proxy Servers. References: CVE-2024-0012, CVE-2024-9474.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-03-11 · new · rule 200013102
  > Added: signature 200013102 "Palo Alto PAN-OS Management Web Authentication Bypass (1)" (Authentication/Authorization Attacks, risk High), systems: PHP, Other Web Server, Proxy Servers. References: CVE-2024-0012, CVE-2024-9474.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-03-11 · new · rule 200013103
  > Added: signature 200013103 "Palo Alto PAN-OS Management Web Authentication Bypass (2)" (Authentication/Authorization Attacks, risk High), systems: PHP, Other Web Server, Proxy Servers. References: CVE-2024-0012, CVE-2024-9474.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2024-0012, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2024-0012, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-0012 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-0012