https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400 A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns. en Fri, 12 Apr 2024 00:00:00 GMT https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400 https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400#2024-04-12-8495a9dd Fri, 12 Apr 2024 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2024-3400">Source</a></p> https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400 https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400#2024-04-12-53a7ed24 Fri, 12 Apr 2024 00:00:00 GMT critical <p><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Source</a></p> https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400 https://pwn.watch/i/palo-alto-pan-os-globalprotect-zero-day-cve-2024-3400#2024-04-12-b4aaa820 Fri, 12 Apr 2024 00:00:00 GMT critical <p><a href="https://security.paloaltonetworks.com/CVE-2024-3400">Source</a></p>