CVE-2024-5912

Description

An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked.

Overview

State: PUBLISHED
Assigner (CNA): palo_alto
CVSS severity: MEDIUM
CVSS score: 6.8 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
Effective score: 6.8 / 10 MEDIUM source: CNA overview
CWE(s): CWE-347
Reserved: 2024-06-12
Published: 2024-07-10 18:40 UTC
Last updated: 2024-08-01 21:25 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/5xxx/CVE-2024-5912.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-07-10 19:15:11 UTC
NVD last modified: 2026-04-15 00:35:42 UTC
EPSS score: 0.0001 (probability of exploitation in next 30 days)
EPSS percentile: 2.20% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-47044
Assigner: palo_alto
Published: Jul 10, 2024, 6:40:16 PM
Updated: Aug 1, 2024, 9:25:03 PM
EUVD base score (CVSS 4.0): 6.8 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
EUVD-reported EPSS: 0.0100
Vendors: Palo Alto Networks
Products: Cortex XDR Agent (7.9-CE <7.9.102-CE)

Cortex XDR Agent (8.2 <8.2.2)
Aliases: GHSA-wjvm-2xmx-5vhg

ENISA description: An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked.

EUVD references (1)

https://security.paloaltonetworks.com/CVE-2024-5912

Affected products (1)

Vendor	Product	Versions	Platforms
Palo Alto Networks	Cortex XDR Agent	`8.4` (unaffected), `8.3-CE` (unaffected), `8.3` (unaffected), `7.9-CE` (affected), `8.2` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.paloaltonetworks.com/CVE-2024-5912 vendor-advisory

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://security.paloaltonetworks.com/CVE-2024-5912 vendor-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://security.paloaltonetworks.com/CVE-2024-5912 psirt@paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2024-5912 af854a3a-2127-422b-91ae-364da2661108

Remediations (10)

CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026.

2026-05-23 22:11 UTC
Microsoft Patch Tuesday, September 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities ...

2026-05-23 22:11 UTC
9 Effective Vulnerability Mitigation Strategies

web:levacloud.com

It's important to understand that vulnerability mitigation strategies are focused on reducing the risk of vulnerabilities being exploited, rather than fully fixing the root cause. Remediation is about permanently resolving a vulnerability, typically through a patch , configuration change, or code update. In contrast, vulnerability mitigation strategies involve putting safeguards in place to ...

2026-05-23 22:11 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 22:11 UTC
SMDU UI Loss Mitigation User Guide - Fannie Mae

web:singlefamily.fanniemae.com

Fannie Mae's SMDU™ UI User Guide provides information on using SMDU for foreclosure prevention evaluations and reporting workouts to Fannie Mae.

2026-05-23 22:11 UTC
Risk and Vulnerability Assessments - CISA

web:www.cisa.gov

Organizations should consider additional attack vectors and mitigation strategies based on their unique environment. Contact To schedule a Risk and Vulnerability Assessment, contact central@cisa.dhs.gov .

2026-05-23 22:11 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-23 22:11 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-23 22:11 UTC
Escape from Tarkov official page

web:www.escapefromtarkov.com

Escape from Tarkov official page

2026-05-23 22:11 UTC
VirusTotal - Home

web:www.virustotal.com

Streamline your investigations with Google Threat Intelligence Agentic and the new Dark Web (DDW) module. Perform hunting and pivoting across forums using natural language or specific modifiers. Bridge threat actor identities and map global operations easy.

2026-05-23 22:11 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-5912.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T14:37:27.359741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-11T14:37:33.165Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:25:03.178Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2024-5912"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "8.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "8.3-CE",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "8.3",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "7.9.102-CE",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.9.102-CE",
              "status": "affected",
              "version": "7.9-CE",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "8.2.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "8.2.2",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks the Cyber Defence Center of BITMARCK, and especially Maximilan Pappert for discovering and reporting this issue."
        }
      ],
      "datePublic": "2024-07-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked."
            }
          ],
          "value": "An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-10T18:40:16.240Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2024-5912"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in Cortex XDR agent 7.9.102-CE, Cortex XDR agent 8.1.3, Cortex XDR agent 8.2.2, and all later Cortex XDR agent versions.<br>"
            }
          ],
          "value": "This issue is fixed in Cortex XDR agent 7.9.102-CE, Cortex XDR agent 8.1.3, Cortex XDR agent 8.2.2, and all later Cortex XDR agent versions."
        }
      ],
      "source": {
        "defect": [
          "CPATR-22565"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-10T16:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "Cortex XDR Agent: Improper File Signature Verification Checks",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-5912",
    "datePublished": "2024-07-10T18:40:16.240Z",
    "dateReserved": "2024-06-12T15:27:56.188Z",
    "dateUpdated": "2024-08-01T21:25:03.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}