A critical severity command injection vulnerability in Palo Alto Networks PAN-OS has been exploited in limited targeted attacks. While a fix is not yet available, patches are expected to be released on April 14 and mitigation steps are available.

CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access

Research shows over 22,500 Palo Alto GlobalProtect instances are possibly vulnerable to this flaw as a public proof-of-concept is available. Immediate patching is recommended.

Details on exploitation of this flaw are now available publicy and patches have begun being released by the vendor. Immediate patching is recommended.

Some hotfixes are now available. Exploitation remains limited to targeted attacks. Apply mitigations until additional hotfixes become available.

Researchers observed a threat actor, UTA0218, exploiting this flaw to deploy a backdoor called UPSTYLE. Apply available mitigations urgently until patches are available.

In the wild exploitation has been observed for this critical severity command injection affecting PAN-OS. Patches are expected soon.

Detections

Analytics

CVE-2024-3400

critical

Vulnerable Software