Palo Alto Networks alerts customers that hackers are exploiting a zero-day in its popular GlobalProtect VPN product and promises a patch by April 14
Cybersecurity giant Palo Alto Networks is alerting customers that a zero-day vulnerability in its firewall tool is being exploited by hackers.
The RecordJonathan Greig
Context & Ripple Effects
This report places Palo Alto Networks' remote-access product in the same immediate-response category as Ivanti's exploited VPN vulnerabilities, where customers were warned before vendor patches were available. The short patch timetable makes the period between disclosure and remediation the central operational issue.
Related coverage later shows further exploited Palo Alto firewall zero-days, while earlier SonicWall and Juniper incidents show that security appliances have repeatedly been high-value targets when flaws affect remote access or firewall administration.
First-order effects
GlobalProtect customers face an active exploitation warning and must prepare to apply Palo Alto Networks' promised patch as soon as it is released.
Palo Alto Networks must move from alerting customers to delivering and supporting a remediation for a flaw in a widely used VPN product.
Second-order effects
Security teams using GlobalProtect will likely elevate monitoring and incident-response work around their VPN perimeter until patching is complete, competing with other urgent infrastructure work.
If exploitation of edge security products continues, the market will put greater weight on how vendors shorten the interval between detection, disclosure, and customer remediation—not only on preventive product claims.
Repeated incidents across vendors could push enterprises toward more resilient remote-access architectures and tighter operational controls around internet-facing security appliances; the corpus does not establish which approaches will prevail.
The trend: Exploited flaws in internet-facing VPN and firewall products are making remediation speed and perimeter resilience a core competitive and operational issue.
@Volexity @PaloAltoNtwks We have seen limited exploitation but impact at multiple customers. We first detected this just two days ago. Impressive response from the Palo Alto Networks team, as they quickly worked with us and have now pushed a Threat Protection signature with a fix…
🛡️ Palo Alto Networks PAN-OS users: We added #CVE-2024-3400, a command injection vulnerability in GlobalProtect Gateway, to our Known Exploited Vulnerabilities Catalog. Apply mitigations to protect your org from cyberattacks. https://go.dhs.gov/Z3Q #Cybersecurity #InfoSec [image]
Researchers with @Volexity discovered exploitation of CVE-2024-3400 on April 10 - however, researchers said that the earliest evidence of attempted exploitation tracks back to March 26. https://duo.com/...
Volexity has released a ton of new insights about CVE-2024-3400 — which they say is likely being exploited by state-backed actors https://therecord.media/...
Great work by the team as always. Finding a zero day always spices up that week's work! What was interesting this time was post exploitation focus on stealing authentication data to enable further activity combined with a lot of forensic cleaning up. 1/
Sigh. CVSS 10 vulnerability in GlobalProtect firewalls under “limited” exploitation. Meaning exploitation probably about to be not-so-limited. Patches due in another two days or so. Need to have gateway & telemetry enabled to be affected. One mitigation is to disable telemetry.🤦…
All three conditions that must exist for this CVE: 1. Running PanOS 10.2 or greater 2. Have GlobalProtect gateway enabled 3. Have device telemetry enabled Places to check for these: 1. Device > Software 2. Network > GlobalProtect > Gateways 3. Device > Setup > Telemetry
RCE on PAN. No patch available. Under active exploitation. Ugh... Looks like a relatively easy workaround in the PAN Advisory ( https://security.paloaltonetworks.com/ ... ) Kudos to @Volexity !
Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory https://security.paloalton…
Our latest blog post details @Volexity's identification & incident response associated with the Palo Alto Networks GlobalProtect #0day vuln, assigned CVE-2024-3400, that the team found being exploited in the wild. Read more here: https://www.volexity.com/... #DFIR #ThreatIntel