CVE-2024-3400Vulnerability

1. “The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication…”

   CybleVendor25 Sep 2026
   Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions

2. “This isn't the first exploitation: Volexity observed .pth abuse in CVE-2024-3400 exploitation.”

   Trend Micro ResearchVendor26 Mar 2026
   Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise

3. “CVE-2021-26855, CVE-2021-44228 (Log4Shell), and CVE-2024-3400 are being actively targeted by threat actors.”

   GreyNoiseVendor6 Mar 2025
   GreyNoise Detects Active Exploitation of Silk Typhoon-Linked CVEs

4. “CVE-2024-3400 – Palo Alto Networks PAN-OS Command Injection”

   GreyNoiseVendor26 Feb 2025
   GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs

5. “Their intelligence revealed a critical vulnerability—CVE-2024-3400—impacting Palo Alto Networks firewall appliances running an outdated PAN-OS software.”

   Group-IBVendor12 Feb 2025
   RansomHub Never Sleeps Episode 1: The evolution of modern ransomware

• exploit[.]inin 1 report
• models.litellm[.]cloudin 1 report
• checkmarx[.]zonein 1 report
• scan.aquasecurtiy[.]orgin 1 report
• 45.148.10[.]212in 1 report
• 83.142.209[.]11in 1 report
• mirror.gcr[.]ioin 1 report

Also named with it: CVE-2020-1472, CVE-2021-26855, CVE-2023-20198, CVE-2021-44228, CVE-2021-42278, CVE-2017-11882, CVE-2023-38831, CVE-2023-36884, CVE-2017-5753, CVE-2022-27925, CVE-2024-21762, CVE-2022-41082, CVE-2023-23397