Loading story…
Palo Alto Networks disclosed CVE-2024-0012, a critical authentication-bypass flaw in the PAN-OS management web interface, and reports tied the issue to active in-the-wild exploitation against internet-exposed firewall management interfaces. Public reporting and vendor guidance indicate the weakness could enable unauthenticated command execution in affected deployments, while Prisma Access and Cloud NGFW were not impacted.
Affected versions included PAN-OS releases earlier than 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, and 11.2.4-h1. Palo Alto Networks first urged customers to restrict management-interface exposure and follow hardening guidance for administrative access, then released fixes for affected branches. Incident-response reporting also cited published indicators of compromise, including attacker IP addresses and a SHA-256 hash for a PHP webshell observed in related activity, underscoring the need to patch exposed devices and review management-plane access controls.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC said it observed attacks targeting PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474, with activity first seen on November 22, 2024 and rising sharply on November 25. The report included exploit details such as use of the X-PAN-AUTHCHECK: off header and attempts to write a payload into the unauth web directory.
Reporting noted that a public exploit existed for CVE-2024-0012 and shared indicators of compromise, including attacker IP addresses and a SHA-256 hash for a PHP webshell tied to observed exploitation. This added technical details about how the attacks were being carried out.
Palo Alto Networks later released fixes for affected PAN-OS branches, including versions 10.2.12-h2, 11.0.6-h1, 11.1.5-h1, and 11.2.4-h1. CSIRT.SK reported these patches were released on 2024-11-20.
Palo Alto Networks published a security advisory for CVE-2024-9474, a privilege escalation vulnerability affecting the PAN-OS web management interface. This established CVE-2024-9474 as a distinct issue later observed in exploit chains with CVE-2024-0012.
Palo Alto Networks disclosed CVE-2024-0012, a critical authentication bypass in the PAN-OS management web interface, and warned that it was being actively exploited in the wild against internet-exposed management interfaces. The advisory said Prisma Access and Cloud NGFW were not affected and recommended restricting management-interface access according to best practices.
Wiz identified Linux implant variants attributed to Daggerfly in attacks exploiting CVE-2024-0012. It also observed compromised virtual PAN-OS devices receiving PHP web shells, Sliver implants, and cryptocurrency miners following exploitation of the CVE-2024-0012/CVE-2024-9474 chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
live.paloaltonetworks.com
Open sourcembsd.jp
Open sourcewiz.io
Open sourcecsirt.sk
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2025-0108**, an authentication bypass flaw in the PAN-OS management web interface, and related reporting shows attackers quickly began probing and exploiting exposed systems. MBSD-SOC said it observed attack attempts starting on 2025-02-14, just two days after public disclosure, and linked the activity to exploitation of both **CVE-2025-0108** and the management interface file-read issue **CVE-2025-0111**. The attacks targeted PAN-OS versions across the `11.1`, `10.2`, and `10.1/11.2` branches, with public proof-of-concept code already available. Observed attack traffic was led by sources in **France**, with additional activity from the **United States, Japan, Russia, and Germany** during February and March 2025. MBSD-SOC published an example HTTP request used to attempt authentication bypass against the web management interface and urged organizations to update affected firewalls immediately to the latest fixed PAN-OS releases, as internet-facing management interfaces remain a high-value target for opportunistic exploitation.
Aug 15, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed and patched **CVE-2026-0300**, a critical `PAN-OS` vulnerability in the **User-ID Authentication Portal** that can let an unauthenticated remote attacker execute arbitrary code with **root** privileges. The flaw, rated **CVSS 9.3**, is described as a stack overflow and out-of-bounds write issue affecting multiple `PAN-OS` release lines, including versions in the `10.2`, `11.1`, `11.2`, and `12.1` branches, on affected **PA Series** and **VM-Series** firewalls. Palo Alto Networks reported signs of **active exploitation**, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
Jul 24, 2026