Palo Alto PAN-OS Management Authentication Bypass (CVE-2024-9474)

CVE-2024-9474 is an authentication bypass in the Palo Alto Networks PAN-OS management web interface. When combined with other flaws, attackers gain privileged access to firewall configuration — changing rules, exporting secrets, and pivoting into internal Linux/Windows networks.

Affected PAN-OS

• PAN-OS 10.2 before 10.2.12-h2
• PAN-OS 11.0 before 11.0.6-h1
• PAN-OS 11.1 before 11.1.5-h1
• Management UI reachable from untrusted networks

Check version

> show system info | match sw-version
> show system setting management

Fix

• Upgrade to vendor-fixed PAN-OS release immediately
• Never expose management plane to the internet — use out-of-band jump host
• Enable MFA for all admin accounts after patch
• Export config baseline and diff for unauthorized rule or user changes

Pair with CVE-2024-0012 chain reports in the wild — patch management access first.