Loading story…
A critical command injection flaw in Palo Alto Networks GlobalProtect exposed internet-facing devices running affected PAN-OS versions to unauthenticated remote code execution with root-level access. Palo Alto confirmed the vulnerability was being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog. The issue affected systems with GlobalProtect enabled on PAN-OS 10.2, 11.0, and 11.1, and public proof-of-concept exploit code increased the urgency for defenders to patch.
Finland’s National Cyber Security Centre said it issued a serious warning after receiving the first breach notifications tied to the flaw and identified several hundred potentially vulnerable Palo Alto devices in domestic networks. About 15 incident reports related to Palo Alto devices were received, though no more serious breach cases were identified. Early vendor guidance that disabling telemetry could mitigate risk was later deemed insufficient, prompting a shift to immediate patching; fixes were released for supported branches including 10.2.9-h1, 11.0.4-h1, and 11.1.2-h3, after which the Finnish warning was withdrawn as the threat subsided.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Palo Alto disclosed a serious PAN-OS vulnerability affecting firewall management interfaces that allows an unauthenticated attacker to invoke certain PHP scripts and impact system integrity and confidentiality. The vendor released fixes for supported PAN-OS 10.1, 10.2, 11.1, and 11.2 versions, while noting exploitation attempts and public proof-of-concept code.
The Finnish National Cyber Security Centre removed its earlier warning because the threat to organizations had subsided after affected devices were updated. This marked the de-escalation of the domestic response to the vulnerability.
During the response period, Finland’s National Cyber Security Centre received around 15 incident reports related to Palo Alto devices, though no more serious breach cases were identified. The reports reflected active domestic impact from the vulnerability.
Finland’s National Cyber Security Centre issued a serious warning about the Palo Alto GlobalProtect vulnerability after receiving the first incident notifications in Finland. The centre observed several hundred potentially vulnerable devices in domestic networks.
By 17 April 2024, Palo Alto had identified fixed releases including PAN-OS 10.2.9-h1, 11.0.4-h1, 11.1.2-h3, and later versions, with additional fixes for older maintenance branches. A Threat Prevention mitigation and support workflows for compromise checks remained available.
By 17 April 2024, it became clear that earlier guidance to disable telemetry was not sufficient protection, especially after proof-of-concept exploit code became public. Defenders were urged to install vendor patches immediately, and CISA had added the issue to its Known Exploited Vulnerabilities catalog.
Palo Alto Networks published initial patches for a critical command injection vulnerability affecting GlobalProtect on PAN-OS 10.2, 11.0, and 11.1. The flaw could allow an unauthenticated remote attacker to gain root access and execute arbitrary code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed and patched **`CVE-2024-3400`**, a critical **CVSS 10.0** flaw in **PAN-OS** that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects **PAN-OS 10.2, 11.0, and 11.1** when **GlobalProtect Gateway or Portal** is enabled, while **Cloud NGFW, Panorama appliances, and Prisma Access** are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures **`95187`**, **`95189`**, and **`95191`** and to urge immediate upgrades. Post-compromise activity tracked by Unit 42 as **Operation MidnightEclipse** showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called **UPSTYLE** and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is **not** an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
Aug 15, 2026
Palo Alto Networks disclosed **CVE-2026-0257**, an authentication bypass flaw in **PAN-OS GlobalProtect portal and gateway** that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while **Cloud NGFW** and **Panorama** were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override. Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to **Vultr** and **Dromatics Systems**. **CISA** added `CVE-2026-0257` to its **Known Exploited Vulnerabilities** catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including **OT/SCADA** networks. A separate Palo Alto advisory released alongside it also addressed **CVE-2026-0262**, a PAN-OS network traffic parsing denial-of-service issue.
Aug 31, 2026
Palo Alto Networks disclosed **CVE-2026-0300**, a critical `CWE-787` buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows **unauthenticated remote code execution as root** on affected **PA-Series** and **VM-Series** firewalls. The flaw carries a **CVSS v4 score of 9.3** when the portal is exposed to untrusted networks or the public internet, and Palo Alto confirmed limited in-the-wild exploitation against exposed portals. Affected versions span PAN-OS 10.2, 11.1, 11.2, and 12.1, while **Prisma Access, Cloud NGFW, and Panorama are not affected**. With patches not immediately available at disclosure, Palo Alto said fixed releases would begin rolling out between May 13 and May 28 and urged customers to restrict portal access to trusted internal zones or disable the feature entirely; the company also released a Threat Prevention Signature for PAN-OS 11.1 and later. U.S. **CISA** added the vulnerability to its **Known Exploited Vulnerabilities** catalog and ordered federal civilian agencies to remediate by the mandated deadline, while other national and regional cyber authorities issued parallel alerts. Palo Alto Unit 42 and multiple reports linked the activity to a likely state-sponsored cluster tracked as **CL-STA-1132**, which reportedly probed targets for weeks, injected shellcode into an `nginx` worker process, deleted crash artifacts and logs, enumerated Active Directory through firewall-linked service accounts, and used **EarthWorm** and **ReverseSocks5** tunnels for command and control and lateral movement. Researchers warned that thousands of internet-exposed PAN-OS instances remain reachable, making perimeter firewalls with exposed Captive Portal services high-priority compromise candidates.
Jun 29, 2026