CVE-2024-2550 is a high severity (CVSS 7.5) NULL pointer dereference in the GlobalProtect gateway of Palo Alto Networks PAN-OS. An unauthenticated packet can stop the GlobalProtect service. Upgrade to PAN-OS 10.2.11, 11.0.6, 11.1.5 or later, per the vendor advisory. The sections below cover how to check your exposure and what to do.
What's affected
PAN-OS firewalls with a GlobalProtect gateway configured. The vendor advisory lists these ranges as affected: 11.1 before 11.1.5 (and 11.1.4 before h9), 11.0 before 11.0.6, and 10.2 before 10.2.11, with hotfix floors of 10.2.7-h21, 10.2.8-h18, 10.2.9-h18 and 10.2.10-h10. PAN-OS 11.2 and 10.1, Cloud NGFW and Prisma Access are listed as unaffected.
The advisory scores it 6.6 (medium, CVSS-BT) and 8.7 on its base score, using CVSS 4.0. NVD lists 7.5 (high) under CVSS 3.1. This is a source conflict in scoring systems, not a disagreement about the flaw, so both are given here.
The NVD record scores it 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, published 2024-11-14. The weakness is classed as CWE-476 (NULL pointer dereference).
The advisory says it is fixed in PAN-OS 10.2.11, 11.0.6, 11.1.5 and all later versions. For smoother upgrade paths it also lists the fixes 11.1.4-h9, 10.2.10-h10, 10.2.9-h18, 10.2.8-h18 and 10.2.7-h21. It says no workaround or mitigation is available.
How to check if you're exposed
The advisory says only firewalls with a GlobalProtect gateway configured are impacted. In the web interface, look for entries under Network, GlobalProtect, Gateways. Then read the running version:
show system info | match sw-version
Compare the result to the fixed versions above.
What to do now
- Check whether a GlobalProtect gateway is configured under Network, GlobalProtect, Gateways.
- Read the PAN-OS version with the command above.
- Upgrade to a fixed release listed in the advisory, such as 10.2.11, 11.0.6 or 11.1.5, or the listed hotfix for your train.
- Plan a maintenance window, since no workaround exists.
- Watch the firewall for unexpected GlobalProtect service restarts.
Why it matters
The weakness is a NULL pointer dereference. Code follows a pointer that was never set, and the process faults. Here the fault stops a service on the firewall. It does not give an attacker code execution or data access according to the advisory, but it removes availability, and repeated triggering is said to push the firewall into maintenance mode.
For an edge device, availability is the whole point. A firewall that drops out of service takes the paths behind it down too, so a high NVD score and a medium vendor score both justify a planned upgrade.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-2550 exploited in the wild?
Palo Alto Networks says it is not aware of malicious exploitation, and the record's KEV flag is false.
Sources
Last reviewed: 19 October 2026.
