Loading story…
Palo Alto Networks disclosed and patched CVE-2024-3400, a critical CVSS 10.0 flaw in PAN-OS that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects PAN-OS 10.2, 11.0, and 11.1 when GlobalProtect Gateway or Portal is enabled, while Cloud NGFW, Panorama appliances, and Prisma Access are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures 95187, 95189, and 95191 and to urge immediate upgrades.
Post-compromise activity tracked by Unit 42 as Operation MidnightEclipse showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called UPSTYLE and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is not an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK published a notice warning that CVE-2024-3400 was critically severe and actively exploited in the wild, and urged organizations to patch immediately. The alert also highlighted that newer information showed telemetry did not need to be enabled for exploitation and shared hunting guidance and indicators of compromise.
MBSD-SOC reported first detecting attacks targeting CVE-2024-3400 on 2024-04-17 and observed detections rise sharply from 2024-04-21 through 2024-04-25. The activity included file-creation attempts via /ssl-vpn/hipreport.esp and command-injection attempts using curl or wget to fetch and execute external payloads.
Palo Alto Networks Unit 42 reported that exploitation tied to CVE-2024-3400 involved limited exfiltration, interactive command execution, and persistence attempts under the name Operation MidnightEclipse. The actor attempted to deploy a custom Python backdoor called UPSTYLE and, after failing, installed a cron job backdoor instead.
Palo Alto Networks released hotfixes and Threat Prevention signatures 95187, 95189, and 95191 to mitigate CVE-2024-3400. Guidance also advised customers to upgrade to patched versions and use protection profiles if immediate patching was not possible.
Palo Alto Networks publicly disclosed CVE-2024-3400 as an arbitrary file creation vulnerability leading to OS command injection in PAN-OS GlobalProtect. The advisory stated the flaw affected PAN-OS 10.2, 11.0, and 11.1 when GlobalProtect gateway or portal was enabled.
Volexity identified active exploitation of a zero-day unauthenticated remote code execution vulnerability in Palo Alto Networks PAN-OS GlobalProtect, later tracked as CVE-2024-3400. The discovery established that affected internet-facing firewalls were being targeted before public disclosure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcecsirt.sk
Open sourcevolexity.com
Open sourcesecurity.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical command injection flaw in **Palo Alto Networks GlobalProtect** exposed internet-facing devices running affected `PAN-OS` versions to unauthenticated remote code execution with **root-level access**. Palo Alto confirmed the vulnerability was being exploited in the wild, and **CISA** added it to the **Known Exploited Vulnerabilities (KEV)** catalog. The issue affected systems with GlobalProtect enabled on `PAN-OS 10.2`, `11.0`, and `11.1`, and public proof-of-concept exploit code increased the urgency for defenders to patch. Finland’s National Cyber Security Centre said it issued a serious warning after receiving the first breach notifications tied to the flaw and identified several hundred potentially vulnerable Palo Alto devices in domestic networks. About 15 incident reports related to Palo Alto devices were received, though no more serious breach cases were identified. Early vendor guidance that disabling telemetry could mitigate risk was later deemed insufficient, prompting a shift to immediate patching; fixes were released for supported branches including `10.2.9-h1`, `11.0.4-h1`, and `11.1.2-h3`, after which the Finnish warning was withdrawn as the threat subsided.
Jun 29, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed **CVE-2026-0257**, an authentication bypass flaw in **PAN-OS GlobalProtect portal and gateway** that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while **Cloud NGFW** and **Panorama** were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override. Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to **Vultr** and **Dromatics Systems**. **CISA** added `CVE-2026-0257` to its **Known Exploited Vulnerabilities** catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including **OT/SCADA** networks. A separate Palo Alto advisory released alongside it also addressed **CVE-2026-0262**, a PAN-OS network traffic parsing denial-of-service issue.
Aug 31, 2026