Palo Alto PAN-OS < 10.2.9-h1 — RCE
A command injection in PAN-OS GlobalProtect allows unauthenticated remote code execution as root. Apply the PAN-OS hotfix for your branch immediately — actively exploited as a zero-day by Volt Typhoon and UTA0218 to deploy Upstyle backdoors.
An unauthenticated attacker achieves root-level remote code execution on the Palo Alto firewall itself — the device that is supposed to protect the network. This gives full control of network traffic, VPN credentials, firewall rules, and a privileged position for lateral movement into the internal network. All VPN users' credentials may be captured.
The GlobalProtect VPN gateway in PAN-OS contains a command injection vulnerability in the telemetry feature. An unauthenticated attacker who can reach the GlobalProtect portal (typically internet-accessible) can inject shell commands that execute as root on the firewall. Device telemetry must be enabled for exploitation (it is enabled by default on many configurations).
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Volexity discovered active exploitation in April 2024 by threat actor UTA0218 (believed to be a nation-state actor). The attackers deployed a Python-based backdoor called Upstyle and used the firewall as a pivot point for internal network reconnaissance. CISA added CVE-2024-3400 to KEV and issued an emergency alert. Palo Alto released hotfixes within 24 hours of public disclosure.
Manual remediation steps
⏱ 1 hour including firewall restartCheck PAN-OS Version
From the firewall CLI:
show system info | match version
Immediate Mitigation (if patching delayed)
# Disable device telemetry (removes the exploited condition)
# In Panorama or device CLI:
set deviceconfig system telemetry-level off
commit
# Verify:
show system telemetry-level
Check for Indicators of Compromise
# Look for suspicious files created by the exploit
find /opt/pancommunity/tmp -name "*.py" -newer /var/log/pan/gpsvc.log
find /var/log -name "gpsvc.log*" -exec grep -l "SESSID" {} \;
Apply the Hotfix
Re-enable Telemetry After Patching
set deviceconfig system telemetry-level enhanced
commit
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References