Critical Palo Alto GlobalProtect Command Injection Led to Active Exploitation

A critical command injection flaw in Palo Alto Networks GlobalProtect exposed internet-facing devices running affected PAN-OS versions to unauthenticated remote code execution with root-level access. Palo Alto confirmed the vulnerability was being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog. The issue affected systems with GlobalProtect enabled on PAN-OS 10.2, 11.0, and 11.1, and public proof-of-concept exploit code increased the urgency for defenders to patch.

Finland’s National Cyber Security Centre said it issued a serious warning after receiving the first breach notifications tied to the flaw and identified several hundred potentially vulnerable Palo Alto devices in domestic networks. About 15 incident reports related to Palo Alto devices were received, though no more serious breach cases were identified. Early vendor guidance that disabling telemetry could mitigate risk was later deemed insufficient, prompting a shift to immediate patching; fixes were released for supported branches including 10.2.9-h1, 11.0.4-h1, and 11.1.2-h3, after which the Finnish warning was withdrawn as the threat subsided.