CVE-2024-3383 is a high severity integrity and availability flaw in Palo Alto Networks PAN-OS. It affects only specific versions and configurations, listed below. Palo Alto Networks rates it CVSS 8.3, while the NVD record shows 7.4. Palo Alto Networks lists fixes in PAN-OS 10.1.11, 10.2.5 and 11.0.3.
What's affected
The advisory lists PAN-OS 11.0 before 11.0.3, PAN-OS 10.2 before 10.2.5, and PAN-OS 10.1 before 10.1.11. It applies only when the Cloud Identity Engine is enabled, under Device, User Identification, Cloud Identity Engine. The record says the way PAN-OS processes data from Cloud Identity Engine agents lets someone modify User-ID groups.
The advisory says PAN-OS 11.1, 9.1 and 9.0, Cloud NGFW and Prisma Access are not affected.
The weakness classes are CWE-282, which covers improper handling of identity data from the Cloud Identity Engine. The NVD record gives the score as 7.4. The Palo Alto Networks advisory gives 8.3. Both put it in the high band. I did not confirm why the numbers differ, so I report both. When you report this internally, say both numbers and name the source of each.
The advisory lists no workaround. Apart from upgrading, its guidance is to verify whether the Cloud Identity Engine is configured on your device. The advisory describes the impact as being to the integrity and availability of user group membership, not to confidentiality.
How to check if you're exposed
- Check the PAN-OS version against the affected ranges: 10.1 before 10.1.11, 10.2 before 10.2.5, and 11.0 before 11.0.3.
- In the web interface, open Device, User Identification, Cloud Identity Engine and see whether it is configured.
- If you run PAN-OS 11.1, 9.1 or 9.0, you are not affected, per the advisory.
- If you are in scope, review recent changes to User-ID group membership for entries you cannot explain.
What to do now
- Identify the PAN-OS version on each firewall, using the web interface dashboard or the
show system infocommand in the CLI. - Upgrade to PAN-OS 10.1.11, 10.2.5 or 11.0.3, or a later release on your branch.
- Apply any workaround the advisory lists while you wait for a change window.
- Schedule the upgrade through your normal change control, testing high availability pairs one member at a time.
- Watch device logs for unexpected restarts and system messages about maintenance mode.
- Record the advisory number and the fixed version in your vulnerability tracker.
Why it matters
User-ID groups feed security policy. Rules that say a certain group may reach a certain resource depend on the group data being right. The record says the flaw means users may be wrongly denied or wrongly allowed access, based on your existing rules. The weakness is CWE-282, improper ownership management.
A wrongly allowed user is a security problem. A wrongly denied user is an outage. Both come from trusting group data that arrived from an agent without enough checks.
Firewalls sit on the path of all traffic, which is why availability flaws in them matter more than the same flaw in an ordinary server. A device that reboots or stops forwarding takes the network segment with it. The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark the flaw as a CISA Known Exploited Vulnerability. That is a reason to patch on schedule, not a reason to wait.
Quick check
What is the fixed version for CVE-2024-3383?
The advisory lists PAN-OS 10.1.11, 10.2.5 and 11.0.3 as fixed, and all later versions. Confirm against the advisory before you plan the change.
Is CVE-2024-3383 exploited in the wild?
The advisory says Palo Alto Networks is not aware of any malicious exploitation, and the record does not mark it as a CISA KEV entry. Check the advisory again before your patch window, since that statement can change.
Sources
Last reviewed: 19 October 2026.
