Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)
Palo Alto Networks PAN-OS
A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.
Why this severity: CVSS 10 (v3.1, CNA), actively exploited (CISA KEV); known ransomware use
- Started
- Apr 12, 2024
- Closed
- Apr 12, 2024
Affected
- PAN-OS 10.2, 11.0 and 11.1 with GlobalProtect (exact hotfix ranges in the Palo Alto advisory)
Fixed in
- Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3
Timeline3
Advisories3
News & write-ups2
Notes & caveats
Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
