CVE-2024-8686

PAN-OS: Command Injection Vulnerability

Severity: High7.2CVSS 3.1, High
EPSS: 1%
Published: 11 Sept 2024
Updated: 17 Jun 2026

Description

Title, description and vendor guidance are quoted from the source records.

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.

Weakness: CWE-78

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

1% probability of exploitation in the next 30 days (percentile 72%).

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

Branch	Affected	Fixed in
11.2	>= 11.2.2	No fix published

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Vendor remediation · PAN-OS

This issue is fixed in PAN-OS 11.2.3 and all later PAN-OS versions.

References

https://security.paloaltonetworks.com/CVE-2024-8686(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record): Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC