CVE-2024-0012

CRITICAL KEV RANSOMWARE NUCLEI

Palo Alto Networks PAN-OS 10.2 11.0 11.1 11.2 - Unauthenticated Authentication Bypass

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-0012 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 18, 2024, with confirmed use in ransomware campaigns. EIP tracks 12 public exploits from researchers including iSee857, watchtowrlabs, Sachinart, including a Metasploit module exploits/linux/http/panos_management_unauth_rce. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2026-22812, demonstrating a command execution vulnerability in OpenCode. The script sends a crafted JSON payload to the '/session/{id}/shell' endpoint to execute the 'id' command, confirming RCE if the response contains 'uid=' and 'gid='.

Description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

Exploits (12)

github WORKING POC 40 stars
by iSee857 · pythonpoc
https://github.com/iSee857/CVE-PoC/tree/main/Networks PAN-OS(CVE-2024-0012).py

The repository contains functional exploit code for CVE-2026-22812, demonstrating a command execution vulnerability in OpenCode. The script sends a crafted JSON payload to the '/session/{id}/shell' endpoint to execute the 'id' command, confirming RCE if the response contains 'uid=' and 'gid='.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenCode (version not specified)
No auth needed
Prerequisites: Network access to the target · Target running OpenCode with vulnerable endpoint exposed
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec SCANNER 24 stars
by watchtowrlabs · infoleak
https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-0012

The repository contains a Nuclei template for detecting CVE-2024-0012, an authentication bypass vulnerability in Palo Alto PAN-OS. The template checks for a specific endpoint and response patterns to identify vulnerable systems but does not include exploit code.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Palo Alto PAN-OS (versions TBD)
No auth needed
Prerequisites: Network access to the management web interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 20 stars
by Sachinart · remote
https://github.com/Sachinart/CVE-2024-0012-POC

This repository contains a functional exploit PoC for CVE-2024-0012, targeting Palo Alto PAN-OS. The exploit leverages command injection via a crafted session creation request and subsequent file access to verify execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto PAN-OS
No auth needed
Prerequisites: Network access to the target system · Target system running vulnerable PAN-OS version
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 8 stars
by TalatumLabs · remote
https://github.com/TalatumLabs/CVE-2024-0012_CVE-2024-9474_PoC

This repository contains a functional exploit for CVE-2024-0012 (authentication bypass) and CVE-2024-9474 (command execution and privilege escalation) in Palo Alto PAN-OS. The exploit automates the process of bypassing authentication, uploading a reverse shell payload in chunks, and executing it on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto PAN-OS
No auth needed
Prerequisites: Target URL · Listener IP · Listener Port
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by dcollaoa · remote
https://github.com/dcollaoa/cve-2024-0012-gui-poc

This repository contains a functional GUI-based exploit for CVE-2024-0012, which involves an authentication bypass and command injection in Palo Alto PAN-OS. The exploit creates a session with crafted data, triggers command execution, and verifies the output.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto PAN-OS
No auth needed
Prerequisites: Network access to the target PAN-OS management interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by Regent8SH · remote
https://github.com/Regent8SH/PanOsExploitMultitool

This repository contains a functional exploit tool for CVE-2024-0012, targeting PAN-OS devices. It includes capabilities for credential dumping, command execution, and reverse shell establishment via command injection and authentication bypass techniques.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS
No auth needed
Prerequisites: Network access to the target PAN-OS device · Target device must be vulnerable to CVE-2024-0012
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by 0xjessie21 · remote
https://github.com/0xjessie21/CVE-2024-0012

The repository contains a functional Python exploit for CVE-2024-0012, an authentication bypass vulnerability in Palo Alto Networks PAN-OS. The exploit leverages command injection via a crafted session creation request to achieve remote code execution (RCE) and can deploy a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS
No auth needed
Prerequisites: Network access to the management web interface of the target PAN-OS device
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS 2 stars
by iSee857 · remote
https://github.com/iSee857/CVE-2024-0012-poc

The repository lacks actual exploit code and instead redirects users to an external link for more PoCs, which is a common tactic for suspicious or malicious repositories. The README provides minimal technical details about CVE-2024-0012 and focuses on external downloads.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 1 stars
by greaselovely · remote
https://github.com/greaselovely/CVE-2024-0012

This repository contains a Python script designed to detect the presence of CVE-2024-0012, an authentication bypass vulnerability in Palo Alto PAN-OS. The script sends HTTP requests with specific headers and checks for markers in the response to determine vulnerability status.

Classification
Scanner 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto PAN-OS Management Web Interface
No auth needed
Prerequisites: Network access to the target PAN-OS management interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by punitdarji · remote
https://github.com/punitdarji/Paloalto-CVE-2024-0012

This PoC exploits a command injection vulnerability in Palo Alto PAN-OS by injecting a payload into the 'user' parameter during session creation, which writes system information to a file. The exploit then triggers execution and verifies the result by checking the created file.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto PAN-OS
No auth needed
Prerequisites: Network access to the target · Target running vulnerable PAN-OS version
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Gr-1m · poc
https://github.com/Gr-1m/cve-2024-0012-poc

This repository contains a functional exploit PoC for CVE-2024-0012, an authentication bypass vulnerability in Palo Alto Networks PAN-OS. The exploit leverages command injection via a crafted session creation request to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS
No auth needed
Prerequisites: Network access to the target PAN-OS management interface
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by watchTowr, sfewer-r7 · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/panos_management_unauth_rce.rb

This Metasploit module exploits an authentication bypass (CVE-2024-0012) and command injection (CVE-2024-9474) in Palo Alto Networks PAN-OS management interface to achieve unauthenticated remote code execution as root. It writes payload chunks to disk, amalgamates them, and executes the payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS (versions 11.2 up to 11.2.4-h1, 11.1 up to 11.1.5-h1, 11.0 up to 11.0.6-h1, 10.2 up to 10.2.12-h2)
No auth needed
Prerequisites: Network access to the PAN-OS management interface (port 443/HTTPS) · Vulnerable PAN-OS version
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Nuclei Templates (1)

PAN-OS Management Web Interface - Authentication Bypass
CRITICALVERIFIEDby johnk3r,watchtowr
Shodan: cpe:"cpe:2.3:o:paloaltonetworks:pan-os" || http.favicon.hash:"-631559155"
FOFA: icon_hash="-631559155"

Scores

CVSS v3 9.8
EPSS 0.9428
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2024-11-18
VulnCheck KEV 2024-11-18
InTheWild.io 2024-11-18
ENISA EUVD EUVD-2024-15815
Ransomware Use Confirmed
CWE
CWE-306
Status published
Products (11)
paloaltonetworks/pan-os 10.2.0 (4 CPE variants)
paloaltonetworks/pan-os 10.2.1 (3 CPE variants)
paloaltonetworks/pan-os 10.2.2 (5 CPE variants)
paloaltonetworks/pan-os 10.2.3 (7 CPE variants)
paloaltonetworks/pan-os 10.2.4 (6 CPE variants)
paloaltonetworks/pan-os 10.2.5 (4 CPE variants)
paloaltonetworks/pan-os 10.2.6 (3 CPE variants)
paloaltonetworks/pan-os 10.2.7 (7 CPE variants)
paloaltonetworks/pan-os 10.2.8 (5 CPE variants)
paloaltonetworks/pan-os 10.2.9 (5 CPE variants)
... and 1 more
Published Nov 18, 2024
KEV Added Nov 18, 2024
Tracked Since Feb 18, 2026