PAN-OS Management Auth Bypass Chain (Lunar Peek)

What to do

1. Confirm every firewall and Panorama runs a fixed release or later (show system info | match sw-version).
2. Restrict management interface access to trusted internal IPs only; remove management profiles from internet-facing dataplane and GlobalProtect interfaces.
3. If you have Threat Prevention, keep Threat IDs 95746, 95747, 95752, 95753, 95759 and 95763 in block mode.
4. Search logs and the filesystem for the Unit 42 IOCs (web shell hash, Trident/7.0 user agent, listed IPs).
5. If an exposed device was unpatched after Nov 18, 2024, treat it as compromised: contact Palo Alto support, rebuild from known-good config, and rotate admin and integrated credentials.

How to check if you are affected or compromised

• Check whether the management UI (often port 4443 on GlobalProtect interfaces) is reachable from outside your network.
• Look for the PHP web shell with SHA256 3C5F9034C86CB1952AA5BB07B4F77CE7D8BB5CC9FE5C029A32C72ADC7E814668 and other Unit 42 IOCs.
• Review management access and system logs from Nov 2024 onward for unexpected admin sessions, command execution, crypto miners or C2 tooling.

What happened#

On November 8, 2024, Palo Alto Networks warned customers about a possible remote code execution issue in the PAN-OS management web interface and told them to lock down access to it. On November 18 it published two CVEs with fixes. CVE-2024-0012 is an authentication bypass: an unauthenticated attacker with network access to the management UI can get administrator privileges. The vendor scores it 9.3 (CVSS 4.0). CVE-2024-9474 (6.9) lets a PAN-OS administrator run actions as root. Chained, they give an unauthenticated attacker root on the firewall.

Unit 42 tracked the exploitation as Operation Lunar Peek. Initial attempts came mostly from anonymous VPN and proxy IPs. After third parties published technical details on November 19, activity rose sharply. Attackers ran commands interactively, dropped an obfuscated PHP web shell, and later deployed open-source C2 tools and crypto miners. Both CVEs went into CISA's Known Exploited Vulnerabilities catalog on November 18, 2024.

Who is affected#

CVE-2024-0012 affects PAN-OS 10.2, 11.0, 11.1 and 11.2 on PA-Series, VM-Series, CN-Series and Panorama. CVE-2024-9474 also affects 10.1 and WildFire appliances. The main fixed builds are 10.1.14-h6, 10.2.12-h2, 11.0.6-h1, 11.1.5-h1 and 11.2.4-h1, and the advisories list hotfixes for many earlier maintenance releases. Cloud NGFW and Prisma Access are not affected.

The key precondition is reachability. Your risk is high only if the management web interface was reachable from the internet or an untrusted network. That includes reaching it through a dataplane interface with a management profile. GlobalProtect portals are not vulnerable themselves, but a management profile on the same interface exposes the UI, typically on port 4443.

Do you really need to act?#

For most well-run networks, no new action is needed today. Palo Alto told Cybersecurity Dive that fewer than 0.5% of deployed firewalls have an internet-exposed management interface. The exposed minority, though, was hit hard. Shadowserver reported about 2,000 compromised devices and over 2,700 still vulnerable in the first week, according to BleepingComputer. Palo Alto disputed that count and said the real number was smaller, without giving one.

The honest verdict as of October 2026 is to check your exposure. If your management UI was never reachable from outside, you are on a fixed release, and you have upgraded since, you can relax. If it was exposed during November 2024 while unpatched, assume someone tried. Patching does not remove a web shell or attacker-created accounts, so verify you are clean.

What to do now#

1. Verify the version on every firewall and Panorama with show system info | match sw-version. Upgrade anything older than the fixed builds.
2. Allow management access only from a trusted internal jump host or admin network. Remove management profiles from internet-facing and GlobalProtect interfaces.
3. If you have Threat Prevention, keep Threat IDs 95746, 95747, 95752, 95753, 95759 and 95763 in block mode, as the vendor advisory recommends.
4. Sweep for the Unit 42 indicators: the web shell hash, the Trident/7.0 user agent, and the listed source IPs.
5. If a device was exposed and unpatched after November 18, 2024, treat it as compromised. Engage Palo Alto support, rebuild from a known-good configuration, and rotate admin, LDAP/RADIUS and API credentials stored on it.

How to tell if you were hit#

Start with exposure. From outside your network, check whether the management UI answers on its public addresses, including port 4443. Then search for the PHP web shell (SHA256 3C5F9034C86CB1952AA5BB07B4F77CE7D8BB5CC9FE5C029A32C72ADC7E814668). It only runs a command when a second POST parameter matches a fixed value, so casual requests will not reveal it. Review management and system logs from November 2024 onward for admin logins you cannot explain, configuration changes, unexpected outbound connections, and CPU spikes consistent with mining. The full IOC list is in Unit 42's GitHub repository, linked from the threat brief.

Timeline#

• Nov 8, 2024 — Palo Alto warns of a possible management interface RCE and advises restricting access.
• Nov 14, 2024 — Palo Alto observes threat activity against the unpatched flaw.
• Nov 18, 2024 — CVE-2024-0012 and CVE-2024-9474 published with fixes. CISA adds both to KEV.
• Nov 19, 2024 — Third-party technical details published. Exploitation rises sharply.
• Nov 20, 2024 — Shadowserver reports about 2,000 compromised devices. Palo Alto later disputes the figure.
• Dec 9, 2024 — CISA deadline for federal agencies to remediate.

Vulnerability records

• CVE-2024-0012 · KEV 2024-11-18 · An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain…
• CVE-2024-9474 · KEV 2024-11-18 · A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Palo Alto Networks — CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface security.paloaltonetworks.com
2. Palo Alto Networks — CVE-2024-9474 PAN-OS: Privilege Escalation in the Web Management Interface security.paloaltonetworks.com
3. Unit 42 — Threat Brief: Operation Lunar Peek unit42.paloaltonetworks.com

Coverage and analysis

1. BleepingComputer — Over 2,000 Palo Alto firewalls hacked using recently patched bugs bleepingcomputer.com
2. Cybersecurity Dive — Palo Alto Networks disputes Shadowserver firewall exploit scans cybersecuritydive.com