---
title: "PAN-OS GlobalProtect (CVE-2024-3400)"
canonical: https://trickest.com/library/pan-os-globalprotect-check-cve-2024-3400
description: "Point hosts at PAN-OS and flag CVE-2024-3400 by version. No confirm: the public probe creates a file on the portal. Version flag only. CISA KEV."
---

# PAN-OS GlobalProtect (CVE-2024-3400)

## Overview

This workflow finds PAN-OS GlobalProtect and sorts each host by whether its version falls in the CVE-2024-3400 range. CVE-2024-3400 is unauthenticated file create on the GlobalProtect portal that leads to command injection. A confirm that writes even a zero-byte file is a write. This graph does not send that cookie. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public portal page, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no confirm node. The public probe creates a file on the portal. Version flag only.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as PAN-OS GlobalProtect, then read the version and compare it to the CVE-2024-3400 floors in the graph.
3. Collect the per-host rows: product match, version, affected flag, and any fetch error.
4. Emit the summary counts: hosts checked, product hits, affected, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether PAN-OS was detected, the version read, and the affected flag.
- **summary.json.** Counts across the list: targets, product hits, affected, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product portal. No session cookie write.

## Sample output

The records below are illustrative and do not come from a real run. They show one PAN-OS host inside the CVE-2024-3400 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://vpn.example.com", "product_detected": true, "version": "11.1.2", "affected": true, "error": null}
{"target_url": "https://vpn.example.org", "product_detected": true, "version": "11.1.2-h3", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2024-3400", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which PAN-OS versions does this flag?

PAN-OS 11.1 before 11.1.2-h3, 11.0 before 11.0.4-h1, and 10.2 before 10.2.9-h1. Hotfix suffixes are part of the compare. The compare uses the version the product itself served.

### Why is there no confirm step?

CVE-2024-3400 is unauthenticated file create. The public probe writes a file on the portal. There is no non-intrusive probe. The DAG stays targets, check, collect, summary.

### Does a flagged host mean CVE-2024-3400 was exploited?

No. A flagged row is patch-lag against the range table. The run does not send the session cookie that creates a file. Treat it as a patching signal.

### Is this check safe on production?

Yes. It only sends read-only GET requests to the portal. It does not log in and it does not create a file.

### Does the check need credentials?

No. It fingerprints the public portal the way an external scanner would.

## Related workflows

- [PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)](/library/pan-os-globalprotect-auth-bypass-check-cve-2026-0257). Reach for it when the next PAN-OS flag is the later auth bypass.
- [Citrix NetScaler RCE (CVE-2026-8452)](/library/citrix-netscaler-rce-check-cve-2026-8452). Reach for it when the next RCE flag is also version-only, no confirm.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when the next host is a different VPN gateway.

---
_Markdown source of https://trickest.com/library/pan-os-globalprotect-check-cve-2024-3400._