Table of Contents

    About the Author

    Connor Jackson

    Connor Jackson

    Connor Jackson is a Security Research Manager at CyberMaxx, with a background in forensics, reverse engineering, and threat-hunting. Check out Connor's LinkedIn

    More Articles

    Additional Resources:

    5 Steps to Implementing Continuous Threat Exposure Management in Your Organization

    5 Steps to Implementing Continuous Threat Exposure Management in Your Organization

    Articles

    5 min read

    Cyber Insurance Challenges: Why Premiums Are Rising, and Coverage Is Harder to Obtain

    Cyber Insurance Challenges: Why Premiums Are Rising, and Coverage Is Harder to Obtain

    Blog Post

    5 min read

    In-the-wild exploitation of Palo Alto PAN-OS 10.2, 11.0, and 11.1 has been observed. This does not affect GlobalProtect gateway or GlobalProtect Portal. This also does not affect cloud firewalls (Cloud NGFW), Panorama appliances or Prisma Access

    A command injection vulnerability enables an unauthenticated attacker to execute arbitrary code with root privileges on the firewall, and has been assigned CVE-2024-3400. This issue is fixed in hotfix releases PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3 and all later PAN-OS versions. Hotfixes for other versions can be found from the Palo Alto advisory link below. Customers with a Threat Prevention subscription can block this by enabling THREAD ID 95187, and applying Vulnerability Protection to GlobalProtect interfaces.

    This activity has currently been attributed to a single threat actor, however with the vulnerability being publicly announced it is likely that other groups will capitalize on organizations that are slow to patch. We recommend patching these devices is made a priority,

    Our threat hunting team has been informed and is actively investigating for signs of compromise of this threat. The CyberMaxx team is continuing to monitor this situation and is working to keep your network safe.