Description
A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | PAN-OS | 11.0.0 – < 11.0.3, 10.1.0 – < 10.1.11, 10.2.0 – < 10.2.8, 9.1, 9.0 | 11.1.0 |
| Palo Alto Networks | Cloud NGFW | — | All |
| Palo Alto Networks | Prisma Access | — | All |
Advisories 3
- ICSA-24-193-11 Siemens RUGGEDCOM APE 1808 CISA ICS & IT advisories · Jan 14, 2026
- SSA-364175 SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.4-h1 Siemens ProductCERT · Jan 13, 2026
- WID-SEC-2024-3130 PaloAlto Networks PAN-OS: Mehrere Schwachstellen ermöglichen Denial of Service und Privilegieneskalation BSI CERT-Bund (WID) · Oct 9, 2024
References
- https://security.paloaltonetworks.com/CVE-2024-9471 vendor-advisory