Back to CVEs & Disclosures
CRITICAL — CVSS 10.0

Palo Alto PAN-OS GlobalProtect Command Injection

Command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software allowing unauthenticated attackers to execute arbitrary code with root privileges.

Status
Vendor Patched & Public Advisory
Reported / Disclosed
2024

Impact

  • Full unauthenticated remote root command execution on firewall gateways.
  • Creation of arbitrary files on the filesystem through session cookie parameter manipulation.
  • Immediate persistence and lateral traversal across internal corporate segments.

Timeline

  1. APRIL 12, 2024

    Palo Alto Networks published advisory confirming zero-day exploitation in the wild.

  2. APRIL 14, 2024

    Hotfixes and mitigation definitions (Threat ID 95187) rolled out globally.

  3. APRIL 16, 2024

    Technical analysis and telemetry review published by the offensive security research community.

aura~
Back to CVEs & Disclosures