What is CVSS and why severity is not risk

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H scores 10.0. That string is the Base vector Palo Alto Networks published for CVE-2024-3400. It says nothing about whether the vulnerability is your problem, because it was never designed to.

CVSS is the Common Vulnerability Scoring System, owned by FIRST.Org. It measures severity: how bad a vulnerability is if exploited, assuming reasonable worst case. Risk needs two inputs that a Base score leaves blank. Whether anyone is exploiting it, and what the affected asset is worth to you.

The four metric groups in 4.0

CVSS v4.0 has four groups, not three.

• Base. Intrinsic properties, constant over time and across environments. Every Base metric is mandatory in a vector string.

• Threat. Characteristics that change over time. In 4.0 this group holds exactly one metric, Exploit Maturity (E), with values Attacked (A), Proof-of-Concept (P), Unreported (U) and Not Defined (X).

• Environmental. Your environment. Security Requirements (CR, IR, AR) and the Modified Base Metrics (MAV, MAC, MAT, MPR, MUI, MVC, MVI, MVA, MSC, MSI, MSA).

• Supplemental. Safety (S), Automatable (AU), Recovery (R), Value Density (V), Vulnerability Response Effort (RE) and Provider Urgency (U). These never change the score.

The spec defines nomenclature for exactly this reason. CVSS-B is Base only, CVSS-BT adds Threat, CVSS-BE adds Environmental, CVSS-BTE adds both. It is blunt about what you will usually be handed: providers such as product maintainers and the National Vulnerability Database typically provide only Base Scores, enumerated as CVSS-B.

Here is the part people miss. In v4.0, Base, Threat and Environmental values are always used in the calculation. Omitting them does not remove them, it defaults them to the highest severity assumption. A CVSS-B of 10.0 is not a score with the context left out. It is a score with the context filled in as worst case on your behalf.

What changed from 3.1

Scope (S) is gone. It was the most inconsistently applied metric in 3.x. It is replaced by two full impact sets: VC, VI, VA for the Vulnerable System, and SC, SI, SA for the Subsequent System.

Attack Requirements (AT) is new, values None (N) or Present (P). It captures prerequisite deployment and execution conditions such as a race condition or a required network injection position. Attack Complexity (AC) now covers only the security-hardening measures an attacker must actively defeat.

User Interaction (UI) gained a third value: None (N), Passive (P) or Active (A) rather than 3.1's None or Required. Stored XSS is Passive. Clicking through a warning dialog is Active.

The Temporal group was renamed Threat and cut down. Remediation Level and Report Confidence are gone, only Exploit Maturity survives. The Supplemental group is new and score-neutral.

Decoding a real vector

Palo Alto Networks publishes CVSS 4.0. Their advisory for CVE-2024-3400, an arbitrary file creation leading to OS command injection in the GlobalProtect feature of PAN-OS, carries this vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red

Component by component:

Everything from AU:Y onward is Supplemental. Strip all five and the score is still 10.0. Note what is absent: there is no E: metric. This vulnerability was found in production use and exploited as a zero day before the advisory, and it still shipped as CVSS-B with Supplemental. The strongest signal about real-world exploitation lives in a metric group the publisher did not populate, because populating it is the consumer's job.

Why Base-only patching orders work wrongly

A queue sorted by Base score is sorted by "how bad could this be for anyone, anywhere". It puts a 9.8 on a lab VM above an 8.1 on an internet-facing gateway under active exploitation. It has no way not to, because both scores were computed with your environment defaulted to maximum sensitivity.

Environmental metrics are the fix the spec offers, and almost nobody applies them. If an appliance sits behind a jump host and is not internet-reachable, MAV:N becomes MAV:A and the score drops. If a system holds no confidential data, CR:L pulls the confidentiality contribution down. A Modified Base Metric replaces the original value in the calculation. That is specified and free, and it requires an asset inventory good enough to answer the questions. That last requirement is why it does not happen.

Patching strictly by Base score looks defensible in a report. It is a way to spend a quarter's remediation capacity in roughly the wrong order and justify every ticket on the way.

EPSS and KEV answer different questions

EPSS, the Exploit Prediction Scoring System, is a machine-learning model that publishes a probability between 0 and 1, updated daily, for published CVEs. The claim is narrow: the estimated likelihood that exploitation activity for that vulnerability will be observed across EPSS data partners in the next 30 days. It ships free as CSV and API.

What EPSS is not: it is not severity, it carries no impact term, it knows nothing about your controls or asset values, and it measures activity observed across partner telemetry rather than attacks against you. A 0.94 on a CVE for a product you do not run is 0.94 and irrelevant.

CISA KEV runs the other direction. It is a catalog of vulnerabilities with confirmed exploitation. Three criteria gate every entry: an assigned CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action such as a vendor update. Federal civilian executive branch agencies must remediate KEV entries within prescribed timeframes under BOD 26-04, issued 10 June 2026, which carries the KEV criteria forward from BOD 22-01.

What KEV is not: not a severity ranking, not a prediction, not exhaustive. Absence from KEV is not evidence that something is not being exploited, only that CISA has not confirmed and published it. Entries are retrospective by construction.

Three questions, three sources. How bad if exploited (CVSS). How likely to be exploited soon (EPSS). Has it been exploited (KEV). Any scheme running on one number answers one of those and guesses at the other two.

When patching lags, detect

CVE-2024-3400 is the case for keeping a detection engineer in the vulnerability loop. The advisory was published 12 April 2024 and initially described a configuration precondition. On 16 April the vendor updated it to state that device telemetry does not need to be enabled for firewalls to be exposed. The recommended secondary mitigation stopped being a mitigation four days in, while the patch rollout was still running. Detection does not have that failure mode, because it keys on behaviour rather than on a configuration assumption.

The exploitation path leaves a specific artifact. The vulnerable code builds a file path from the SESSID cookie value, so the payload arrives inside that cookie. When PAN-OS fails to parse the value as a session, it writes a line to /var/log/pan/gpsvc.log. A normal failure looks like this, with a GUID:

failed to unmarshal session(231a1dab-b57e-6cf4-b324-32ba72bba34c) map , EOF

An exploitation attempt puts a filesystem path or shell metacharacters between the parentheses instead. The vendor's own triage grep is:

grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*

Post-exploitation, Volexity documented UTA0218 deploying the UPSTYLE Python backdoor at /usr/lib/python3.6/site-packages/system.pth, which auto-executes on Python startup, reads operator commands out of /var/log/pan/sslvpn_ngx_error.log, and writes output to a file served by the public GlobalProtect portal. That is T1190 for the entry and T1059.004 for the execution.

The rule

We wrote this against the documented log artifact, not against a live appliance. We have not detonated the exploit in a lab, and the rule is untested against real traffic.

title: PAN-OS GlobalProtect Session Parse Failure With Path Or Shell Metacharacters
status: experimental
description: >
  Detects gpsvc.log session unmarshal failures where the session value is not a
  GUID but contains a filesystem path or shell metacharacters, the artifact left
  by CVE-2024-3400 exploitation attempts against PAN-OS GlobalProtect.
references:
  - https://security.paloaltonetworks.com/CVE-2024-3400
  - https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: pan_os
  service: gpsvc
detection:
  selection_parse_failure:
    message|contains: 'failed to unmarshal session('
  selection_traversal:
    message|contains:
      - '../'
      - '/var/appweb/'
      - '/usr/lib/python3.6/site-packages/'
  selection_shell:
    message|contains:
      - '`'
      - '$('
      - 'base64'
      - 'curl '
      - 'wget '
  condition: selection_parse_failure and (selection_traversal or selection_shell)
falsepositives:
  - Vulnerability scanners and attack-surface tools replaying the public proof of concept against the portal
  - Log pipelines that URL-decode or truncate the message field before indexing, which changes what the contains matches see
level: high

What it catches: the parse failure is written whether or not the injected command succeeds, so attempts and successes both land in the same place. That makes it an exposure signal, not only a compromise signal.

What it misses, and this list is the honest part:

• product: pan_os and service: gpsvc are not in the standard Sigma taxonomy. The rule needs a custom pipeline and, before that, gpsvc.log forwarded off the appliance. Most estates do not ship appliance logs by default, which is the real blocker.

• An operator who rotates or truncates gpsvc.log after landing removes the evidence. Post-exploitation, they have root.

• A payload carrying none of the listed strings does not match. The metacharacter list is a heuristic, not a grammar.

• It says nothing about the second stage. Pair it with an integrity check on /usr/lib/python3.6/site-packages/system.pth and on unexpected files under the portal directories.

Summary

CVSS measures severity under worst-case assumptions, and the published number is almost always CVSS-B, meaning the Threat and Environmental context was defaulted rather than assessed. EPSS estimates the probability of exploitation activity being observed in the next 30 days. KEV records exploitation already confirmed. Ordering remediation on Base score alone is not neutral, it encodes the assumption that every asset you own is the most sensitive one it could be. Where the patch cannot land fast enough, the compensating control is a detection keyed on the exploit's log artifact, and that detection survives the vendor changing its mind about the mitigation.

Artifacts to collect for CVE-2024-3400 specifically:

/var/log/pan/gpsvc.log*                          session unmarshal failures
/var/log/pan/sslvpn_ngx_error.log                UPSTYLE command channel
/usr/lib/python3.6/site-packages/system.pth      UPSTYLE backdoor location
/var/appweb/sslvpndocs/global-protect/           unexpected portal-served files

If you are building the fallback layer for network appliances, start with the network detections in the catalog. If the syntax above is unfamiliar, what Sigma rules are covers the format first.