Active Exploitation of PAN-OS Management Interface Authentication Bypass

Palo Alto Networks disclosed CVE-2024-0012, a critical authentication-bypass flaw in the PAN-OS management web interface, and reports tied the issue to active in-the-wild exploitation against internet-exposed firewall management interfaces. Public reporting and vendor guidance indicate the weakness could enable unauthenticated command execution in affected deployments, while Prisma Access and Cloud NGFW were not impacted.

Affected versions included PAN-OS releases earlier than 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, and 11.2.4-h1. Palo Alto Networks first urged customers to restrict management-interface exposure and follow hardening guidance for administrative access, then released fixes for affected branches. Incident-response reporting also cited published indicators of compromise, including attacker IP addresses and a SHA-256 hash for a PHP webshell observed in related activity, underscoring the need to patch exposed devices and review management-plane access controls.