CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface

Source-specific exposure conditions

• PAN-OS 10.2, 11.0, 11.1, or 11.2 running an affected release on PA-Series, VM-Series, or CN-Series firewalls, or Panorama.
• The management web interface is reachable from the internet or another untrusted network, either directly or through a dataplane interface with a management interface profile.
• A management profile on an interface hosting a GlobalProtect portal or gateway can expose the device through the management web interface, typically on port 4443.
• Cloud NGFW, Prisma Access, PAN-OS 10.1, and GlobalProtect portal/gateway services themselves are not affected; however, management access configured on those interfaces can still create exposure.

Source-specific remediation

• Upgrade PAN-OS to the applicable vendor-fixed release: 10.2.12-h2 or later; 11.0.6-h1 or later; 11.1.5-h1 or later; or 11.2.4-h1 or later.
• Where an in-branch maintenance release is required, use the vendor-listed fixed maintenance release for that branch, such as 10.2.0-h4, 11.0.0-h4, 11.1.0-h4, or 11.2.0-h1, as applicable.
• Immediately restrict management-interface access to trusted internal IP addresses or an approved jump host; do not expose it to the internet or other untrusted networks.
• If a Threat Prevention subscription is available, configure the vendor-specified Threat IDs 95746, 95747, 95752, 95753, 95759, and 95763 in block mode and meet the vendor's traffic-inspection prerequisites.
• If timely upgrade or mitigation is unavailable, follow CISA guidance to discontinue use of the affected product.

Source-specific verification

• Confirm the installed PAN-OS version and hotfix meet the applicable vendor-fixed threshold for the release branch.
• Confirm that the management interface is reachable only from trusted administrative networks or the designated jump host, and that no internet-facing dataplane management profile remains enabled.
• If the management interface was externally exposed, review administrative logs and configuration history for unrecognized users, suspicious activity, or unexpected configuration changes; consult Palo Alto Networks telemetry or uploaded technical-support-file analysis where available.
• Do not perform exploit attempts or unauthenticated probing against production devices.

Uncertainty and evidence gaps

• The supplied record's affected CPE list is truncated, so individual hotfix applicability should be checked against the vendor's complete product-status table.
• The record includes a last_modified timestamp of August 4, 2026, while the vendor advisory returned by search states it was updated March 3, 2025; this enrichment relies on the current authoritative advisory content returned from Palo Alto Networks and NVD.
• Successful remediation or absence of compromise cannot be established without the device's actual version, management-interface configuration, and logs.

Claim-to-source evidence

• Affected Product: The vulnerability affects PAN-OS 10.2, 11.0, 11.1, and 11.2 on PA-Series, VM-Series, and CN-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not impacted. Evidence
• Affected Version: Palo Alto Networks lists affected releases below the corresponding fixed thresholds in PAN-OS 10.2, 11.0, 11.1, and 11.2. Evidence
• Exposure: Exposure is greatest when the management interface is accessible from the internet or an untrusted network, including through a dataplane interface with a management interface profile; a management profile on a GlobalProtect interface can expose the management web interface. Evidence
• Fixed Version: The issue is fixed in PAN-OS 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, 11.2.4-h1, and later versions, with additional fixed maintenance releases listed by branch. Evidence
• Remediation: Palo Alto Networks recommends restricting management-interface access to trusted internal IP addresses and documents Threat Prevention mitigations using specified Threat IDs and prerequisites. Evidence
• Verification: For potentially exposed devices, Palo Alto Networks advises monitoring for suspicious threat activity, unrecognized configuration changes, and suspicious users, and describes telemetry and technical-support-file review. Evidence
• Exposure: CISA lists CVE-2024-0012 as a Known Exploited Vulnerability and requires mitigation or discontinuation when mitigations are unavailable; affected management interfaces should not be exposed to untrusted networks, including the internet. Evidence

Synthesis sources

• security.paloaltonetworks.com
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-08-04T12:16:01Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

c56bb05de532d969d4393c9a07b6611ceb62bf2732621f51d264e7fa3d86b5c2