CASCACascade Atlas

Evidence dossier

CVE-2024-3400

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Exploited in the wild (CISA KEV since Apr 12, 2024). NVD reports CVSS 3.1 10.0. EPSS estimates 100.0% exploit likelihood as of Jul 18, 2026.

87.6–92.9Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

State
PUBLISHED
Published
Apr 12, 2024
Updated
Oct 21, 2025
Evidence coverage
98%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    palo_alto

    Record text: PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

    Inspect raw assertion
    Field
    container
    Value
    PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Palo Alto Networks PAN-OS Command Injection Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Palo Alto Networks PAN-OS Command Injection Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 100% probability · 100th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.999990000000; percentile 1.000000000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Apr 12, 2024 · first observed Jul 19, 2026

Exploit likelihood100.00%

FIRST EPSS · score date Jul 18, 2026 · 100th percentile · first observed Jul 19, 2026

SeverityCVSS 10.0

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

Outside this view’s verified evidence

Reason detail begins outside this selected snapshot; the state remains source-bound.

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
palo_altoOriginal assertion
Record text

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

Inspect raw assertion
Field
container
Value
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Palo Alto Networks PAN-OS Command Injection Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Palo Alto Networks PAN-OS Command Injection Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

100% probability · 100th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.999990000000; percentile 1.000000000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
52Underlying assertions
1Canonical products
52Target assertions
0Constraint assertions

Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

7 scope groups

CISA-ADP · source assertedpaloaltonetworkspan-osDirect source scope
Affected: 10.2.0 to before 10.2.9-h1 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.2.0", "lessThan": "10.2.9-h1", "versionType": "custom"}]
CISA-ADP · source assertedpaloaltonetworkspan-osDirect source scope
Affected: 11.0.0 to before 11.0.4-h1 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "11.0.0", "lessThan": "11.0.4-h1", "versionType": "custom"}]
CISA-ADP · source assertedpaloaltonetworkspan-osDirect source scope
Affected: 11.1.0 to before 11.1.2-h3 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "11.1.0", "lessThan": "11.1.2-h3", "versionType": "custom"}]
palo_alto · source assertedPalo Alto NetworksCloud NGFWDirect source scope
Unaffected: All
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "unaffected", "version": "All"}]
palo_alto · source assertedPalo Alto NetworksPAN-OSDirect source scope
Unaffected: 9.0.0Unaffected: 9.1.0Unaffected: 10.0.0Unaffected: 10.1.0Affected: 10.2.0 to before 10.2.9-h1 (custom comparison)Affected: 11.0.0 to before 11.0.4-h1 (custom comparison)Affected: 11.1.0 to before 11.1.2-h3 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "unaffected", "version": "9.0.0"}, {"status": "unaffected", "version": "9.1.0"}, {"status": "unaffected", "version": "10.0.0"}, {"status": "unaffected", "version": "10.1.0"}, {"status": "affected", "version": "10.2.0", "lessThan": "10.2.9-h1", "versionType": "custom"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.4-h1", "versionType": "custom"}, {"status": "affected", "version": "11.1.0", "lessThan": "11.1.2-h3", "versionType": "custom"}]
palo_alto · source assertedPalo Alto NetworksPrisma AccessDirect source scope
Unaffected: All
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "unaffected", "version": "All"}]
NVD CPE · OPERATING SYSTEMpaloaltonetworkspan-osVulnerable target · 52 assertions
Version 10.2.0; Version 10.2.1; Version 10.2.2; Version 10.2.3; Version 10.2.4; Version 10.2.5; Version 10.2.6; Version 10.2.7; Version 10.2.8; Version 10.2.9; Version 11.0.0; Version 11.0.1; Version 11.0.2; Version 11.0.3; Version 11.0.4; Version 11.1.0; Version 11.1.1; Version 11.1.2Canonical identity product-612afb736440531327cd224402d663e14e2a3f421cc65267d8acade0f3b99df7Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4b86668f-7bc5-4f50-ae80-e99f6de370d7
  2. cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bec5e9d4-1b58-4c89-8b68-47f996c04234
  3. cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    156da55e-4152-47bf-a067-136eec9ade22
  4. cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 37
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c25ad9ea-7ddc-4704-9d7c-a1d6c1f5f696
  5. cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    33340036-0e81-41cd-afc4-480f509f8dd2
  6. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a7fcfb45-1150-4f9c-8e4b-3db2ade89454
  7. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c8c4ac1f-4ff0-4500-afbb-f29613358156
  8. cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 34
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    10a69dae-5ad5-4e1c-9df0-c7b7bb023b66
  9. cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 41
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d27a5944-fcd8-44ab-9986-0fca24e81f5b
  10. cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 39
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5e1d99d8-300c-4985-835c-3eba2bfc098b
  11. cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0f30a71d-281e-4bf8-803f-05b517399c6a
  12. cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 43
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a0ed8e63-b8f0-482a-a8a9-13c21d60eeb9
  13. cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 49
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2dc41d6e-8632-44bb-bc05-7c22a02306a2
  14. cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    135588b5-6771-46a3-98b0-39b4873fd6fd
  15. cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 26
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b3aad4ba-22dd-43d3-91f1-8a6f5fbbf029
  16. cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b3af86bd-c317-45c7-96b6-34bd82579fdb
  17. cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 32
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b5e7efd5-2179-45bf-bf5b-197b66903d9c
  18. cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9d1fac78-7714-48ec-9fdb-1a565814b958
  19. cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5d7986dc-187d-4798-8b4a-7d23df0ee0c8
  20. cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    619ad3da-9384-4cc5-9f3d-66db5a055bcb
  21. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6fe16ca7-422a-4a53-8ddc-cb3a982c154f
  22. cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 31
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8bb72e15-486f-491f-a08d-e1ac2c8ab121
  23. cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 38
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2416c2ef-1085-493d-84d7-18f7577d4a01
  24. cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 36
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    50ea3eac-91bd-4b30-a885-bed95b48cc3f
  25. cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 28
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cbe09375-a863-42ff-813f-c20679d7c45c
  26. cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 42
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b4425f47-446d-49c1-aac9-5f5b7e5422a6
  27. cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 27
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    776e06ec-2fda-4664-ab43-9f6be9b897ca
  28. cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 29
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5d64390f-f870-4dbf-b0fe-bcdfe58c8685
  29. cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6adf2a5b-dc55-44b1-a033-4a29c32ab5b1
  30. cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 25
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a8c42d98-cf8f-456b-9d57-80bbdc2c8e74
  31. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    50f0801b-fc9f-4018-a837-cab8cb9c9cd4
  32. cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    aee36b5c-262e-42b0-b3c1-5eaa003e84b7
  33. cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 30
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d814f3a3-5e9d-426d-a654-1346d9ece9b3
  34. cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1360c403-bcd8-420e-b907-4127e12b3a3a
  35. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a79c13fd-c909-4fee-ae24-a085e953d887
  36. cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    98f219ad-a22f-47ac-88fe-b3f75ae059ac
  37. cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dddeb31f-efdd-4a66-9687-7ffcf8efdaaf
  38. cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 46
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    82fba0c5-1385-42dd-a85d-da1d818d0ef3
  39. cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 51
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    275872c1-1ebb-4447-8c9f-347f757bff42
  40. cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 50
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5f7627b3-a463-4570-ba23-663feb7b4a8b
  41. cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 48
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b3d65f1c-b055-408e-b7f2-512f13bedca6
  42. cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    20673f1e-733d-41c4-a644-c482431c26ec
  43. cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5cb7f608-4f03-46ef-a27e-4c8f5363ff5e
  44. cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f54b40ac-a555-4447-b147-576d17cab12a
  45. cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 35
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dfaa23e0-232d-42aa-a5a9-87063348d0df
  46. cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:h5:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 44
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9110dbfb-07d6-4d64-a8aa-c0e7a7037a87
  47. cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 33
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3ef4ae4f-36f3-4923-ae1e-de9e036d4e2f
  48. cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 40
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8b689fad-0469-4222-a7ef-3268ccda43a7
  49. cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 45
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    723956e9-11fd-42a0-8a35-c1fde9e1877c
  50. cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c2d2f5c4-7acc-4514-adbd-3948158b93cc
  51. cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 24
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    09f61a78-1b7c-41f1-a0d8-0ab1e7adf68c
  52. cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:h1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 47
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6fac22eb-fb4c-4e9d-99a1-d4902262ed06

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 0 source-reported links

Applicability remains source-scoped; safety and exposure remain unassessed.

Assessments

CVSS by origin

10.0
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0
psirt@paloaltonetworks.comCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0
palo_altoCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.