Palo Alto PAN-OS GlobalProtect Zero-Day Enabled Unauthenticated RCE
Active Exploitation · 5 sources · Updated 3mo ago · First seen Apr 19, 2024
Palo Alto Networks disclosed and patched CVE-2024-3400, a critical CVSS 10.0 flaw in PAN-OS that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects PAN-OS 10.2, 11.0, and 11.1 when GlobalProtect Gateway or Portal is enabled, while Cloud NGFW, Panorama appliances, and Prisma Access are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures 95187, 95189, and 95191 and to urge immediate upgrades.
Post-compromise activity tracked by Unit 42 as Operation MidnightEclipse showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called UPSTYLE and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is not an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
