What We Do
How We Do
Get Started
Security advisories

Update: Zero-Day Vulnerability Impacts Palo Alto (CVE-2024-3400)

April 16, 2024 | 2 MINS READ

Speak With A Security Expert Now



On April 12th, 2024, Palo Alto Networks disclosed a critical, actively exploited vulnerability in Palo Alto Networks’ firewalls. Tracked as CVE-2024-3400 (CVSS: 10), this is a command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software. Exploitation of CVE-2024-3400 would allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the firewall.

The vulnerability, along with real-world exploitation, was identified by Volexity and reported to Palo Alto. As exploitation has been confirmed, it is critical that organizations apply the security patches provided by Palo Alto as soon as possible. Alternative mitigations are available if patches cannot be applied immediately.

What we’re doing about it

What you should do about it

Additional information

CVE-2024-3400 resides in the PAN-OS operating system; it specifically impacts PAN-OS versions 10.2, 11.0, and 11.1. The following “hotfixes” were released on April 14th to address the vulnerability: PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, and PAN-OS 11.1.2-h3. Palo Alto Networks Panorama appliances, Cloud NGFW, and Prisma Access solutions are not impacted.

Palo Alto’s Unit42 has released a report including details on observed attacks and known Indicators of Compromise (IoCs); the current campaign is being tracked under the name Operation MidnightEclipse. After initial exploitation, threat actors have been observed deploying reverse shells and the UPSTYLE backdoor, as well as executing a variety of commands on the firewall, including copying and exfiltrating configuration files. Volexity tracks the threat actor group behind Operation MidnightEclipse as UAT0218.

On April 16th, watchTowr released a technical analysis of CVE-2024-3400. Their analysis reveals that manipulation of the SESSID cookie can lead to arbitrary file writes and potentially command execution, showcasing an attack vector where telemetry settings increase vulnerability. Rather than releasing traditional Proof-of-Concept (PoC) exploit code, they chose to demonstrate the exploit's viability through a hypothetical scenario that explains the step-by-step manipulation process. The goal of this method is to both inform security professionals about the severity and mechanics of the exploit and to prompt rapid remediation efforts without equipping potential attackers with a ready-made exploit script. While crucial for informing and protecting the cybersecurity community, this information inevitably carries the risk of aiding threat actors. Such detailed disclosures, especially those involving step-by-step exploitation methods or revealing specific weak points in software, can serve as a blueprint for malicious actors. This accessibility of information can lower the barrier for entry for less skilled attackers to exploit these vulnerabilities, potentially leading to an increase in the number of threat actors attempting to leverage the exploit. The eSentire Threat Intelligence team assesses with moderate confidence that more threat actors will attempt to exploit CVE-2024-3400 following the release of these technical details.


[1] https://security.paloaltonetworks.com/CVE-2024-3400
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-3400
[3] https://twitter.com/stevenadair/status/1778724526274052445
[4] https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/device-telemetry/device-telemetry-configure/device-telemetry-disable
[5] https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184
[6] https://unit42.paloaltonetworks.com/cve-2024-3400/
[7] https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
[8] https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

View Most Recent Advisories