Apr 12, 2024
1 new incident, 0 with updates.
Started
- ClosedPatched
Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)
A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.
Palo Alto Networks PAN-OSClosed Apr 12, 2024
