RetrospectiveExploited in the wildCRITICALCISA KEV

PAN-OS GlobalProtect command injection gave unauthenticated root, exploited as a zero-day

An unauthenticated file-creation bug in GlobalProtect chained into root command execution on PAN-OS 10.2, 11.0 and 11.1 firewalls. A suspected state actor exploited it for weeks before disclosure. Patch, check gpsvc logs, and reset devices that show exfiltration or interactive access.

Palo Alto Networks PAN-OS (GlobalProtect gateway/portal)CVE-2024-3400CVSS10.0CWE-77Edge & VPN
Published Oct 22, 2026 · Updated Oct 22, 2026

Exploited as a zero-day from 2024-03-26 by a cluster Volexity tracks as UTA0218, confirmed by Palo Alto and added to CISA KEV on disclosure day; attempts grew after public exploit details on 2024-04-16 6,15,2,9.

Mar 26, 202428 daysApr 23, 2024

What you need to know

  • Affects PAN-OS 10.2, 11.0 and 11.1 firewalls with a GlobalProtect gateway or portal; telemetry state does not matter.
  • Unauthenticated attackers get root command execution on the firewall (CVSS 10.0).
  • Exploited as a zero-day since 2024-03-26 by UTA0218, which backdoored firewalls and moved into internal networks.
  • Fixed in per-release hotfixes, first 10.2.9-h1, 11.0.4-h1 and 11.1.2-h3; disabling telemetry is not a fix.
  • Hunt gpsvc logs for session-load failures where a file path appears instead of a GUID.

What's happening

CVE-2024-3400 is a command injection flaw in the GlobalProtect feature of PAN-OS that lets an unauthenticated remote attacker run code as root on the firewall 15,2. Palo Alto scored it CVSS 10.0 2. Firewalls running PAN-OS 10.2, 11.0 or 11.1 with a GlobalProtect gateway or portal configured are affected, while Cloud NGFW, Panorama and Prisma Access are not 15,2. PAN-OS 10.1, 10.0, 9.1 and 9.0 are not affected 15,4.

The advisory's scope changed after disclosure. On 2024-04-12 Palo Alto said only devices with both the GlobalProtect gateway and device telemetry enabled were exposed 7,13. On 2024-04-14 it clarified that GlobalProtect portal configurations are also affected 15,4. On 2024-04-16 the telemetry condition was removed, and Palo Alto stated that "disabling device telemetry is no longer an effective mitigation" 15,8.

Volexity detected the attacks on 2024-04-10 and traced attempts back to 2024-03-26 6. It tracks the actor as UTA0218 and considers it highly likely to be state-backed, without linking it to a known group 7. Unit 42 calls the activity Operation MidnightEclipse and assessed with high confidence that the exploitation it analyzed came from a single actor 7. CISA added the CVE to KEV on 2024-04-12 2,1. watchTowr published a root-cause analysis on 2024-04-16 that included a working exploit request 5,8. Shadowserver and GreyNoise then recorded exploitation attempts, and Palo Alto updated its advisory to cite an increasing number of attacks 9,15. Shadowserver estimated about 22,542 exposed firewalls were likely still vulnerable on 2024-04-18 11.

How it works

The bug chains two weaknesses that Palo Alto described as not critical on their own 11. In the first, the GlobalProtect session service (gpsvc, running as root) builds a session file path from the SESSID cookie without stripping path separators or traversal sequences 5. An unauthenticated request can therefore create an empty file, along with any missing directories, at a location the attacker chooses, though it cannot control the file's contents 5.

In the second, a scheduled telemetry job (dt_curl) uploads files from a telemetry temp directory and passes each filename into a shell command string 5. A filename planted through the first bug is therefore interpreted by the shell, which turns the empty-file primitive into command execution as root 5,11. watchTowr notes that the file-creation step does not depend on telemetry being enabled 5. Palo Alto later confirmed that telemetry has no bearing on exposure, and The Hacker News ties that change to bypasses found by Bishop Fox 11.

After exploitation, Volexity saw UTA0218 install a Python backdoor called Upstyle, add a cron job that pulled and ran remote content, and deploy reverse shells and GOST proxying 7. The actor also exfiltrated firewall configuration and used a privileged firewall service account to reach internal hosts over SMB and WinRM 7. From there it took the Active Directory database, Windows event logs and browser credential and cookie data 7.

What to do

In order of priority
  1. 1

    Upgrade to the fixed hotfix for your maintenance release. The first fixes (10.2.9-h1, 11.0.4-h1, 11.1.2-h3) shipped on 2024-04-14, and the last (including 10.2.0-h3 through 10.2.4-h16, 11.0.0-h3 and 11.0.1-h4) on 2024-04-18 15.

  2. 2

    Until patched, Threat Prevention subscribers should enable Threat IDs 95187, 95189 and 95191 (content 8836-8695 or later) and apply vulnerability protection to the GlobalProtect interface 15,16.

  3. 3

    Do not rely on disabling device telemetry, because Palo Alto withdrew it as a mitigation on 2024-04-16 15,8,4.

  4. 4

    Remediate according to Palo Alto's exploitation levels. For Level 0 (probe) or Level 1 (test file created), update to the fixed release. For Level 2 (files such as running_config.xml copied to a web-accessible path), add a Private Data Reset. For Level 3 (interactive access), perform a Factory Reset 12,16.

  5. 5

    If compromise is suspected, preserve logs and a tech support file, hunt for lateral movement from the firewall, and treat everything stored on the device as exposed 7. Volexity saw UTA0218 use a privileged service account to move laterally 7, so it is prudent to rotate that account and any other credentials the firewall holds.

Detection

  • Run Palo Alto's log check on the firewall: grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log*. A file system path between session( and ) instead of a GUID-style value marks an exploitation attempt that needs investigation 15,10.
  • Look for unexpected zero-byte files in web-served directories and under /opt/panlogs/tmp/device_telemetry/ 5. Review telemetry (dt) log entries for filenames containing shell syntax, and GlobalProtect /ssl-vpn/ requests whose session cookie carries path separators or traversal 5.
  • Generate a Tech Support File and review it for compromise artifacts, as both Palo Alto and Volexity advised 6,13.
  • On the network, flag direct-to-IP HTTP downloads from the firewall, SMB or RDP sessions originating from the GlobalProtect device, and SMB transfers of browser profile data 6.
  • Check whether Threat Prevention Threat IDs 95187, 95189 and 95191 are firing on the GlobalProtect interface; all three need Applications and Threats content 8836-8695 or later 15,16. Threat ID 95187 first shipped in content 8833-8682 13,4.
  • Correlate edge traffic with GreyNoise's tag palo-alto-pan-os-cve-2024-3400-rce-attempt to separate opportunistic scanning from targeted activity 14.

Indicators

As published by the cited sources
TypeValueContext
file path/usr/lib/python3.6/site-packages/system.pthPython path file used to install the Upstyle backdoor6
file path/var/appweb/sslvpndocs/global-protect/portal/css/bootstrap.min.cssLegitimate file abused by Upstyle to write command output; check for tampering6
otherworldtimeapi[.]org/api/timezone/etc/utcLegitimate service; requests to it from the firewall were flagged by Volexity as suspicious6

Timeline

  1. Earliest exploitation attempts later identified by Volexity 6

  2. Volexity detects exploitation at a customer; payloads deployed 6

  3. Palo Alto advisory; Volexity and Unit 42 reports; CISA adds to KEV 15

  4. First hotfixes released: 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 15

  5. Advisory clarifies that GlobalProtect portal configurations are also affected 15

  6. Advisory drops telemetry precondition and the telemetry workaround; watchTowr publishes root-cause analysis with a working exploit request 8

  7. Shadowserver estimates about 22,542 exposed firewalls likely vulnerable 11

  8. Last hotfixes released for older maintenance releases (10.2.0-h3 to 10.2.4-h16, 11.0.0-h3, 11.0.1-h4) 15

  9. CISA KEV federal remediation due date 2

  10. Palo Alto publishes remediation KB with exploitation levels 3

Sources

  1. 1
    Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400
    CISA · Government · Apr 12, 2024
  2. 2
    CVE-2024-3400 Detail (incl. CISA KEV entry)
    NIST NVD · Database · Apr 12, 2024
  3. 3
    CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild
    Tenable · Research · Apr 12, 2024
  4. 4
    CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls
    Rapid7 · Research · Apr 12, 2024
  5. 5
    Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)
    watchTowr Labs · Research · Apr 16, 2024
  6. 6
    Palo Alto Networks zero-day exploited since March to backdoor firewalls
    BleepingComputer · News · Apr 13, 2024
  7. 7
    State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls
    SecurityWeek · News · Apr 12, 2024
  8. 8
    Exploit released for Palo Alto PAN-OS bug used in attacks, patch now
    BleepingComputer · News · Apr 16, 2024
  9. 9
    Exploitation of Palo Alto Firewall Vulnerability Picking Up After PoC Release
    SecurityWeek · News · Apr 17, 2024
  10. 10
    Palo Alto Networks Releases Urgent Fixes for Exploited PAN-OS Vulnerability
    The Hacker News · News · Apr 15, 2024
  11. 11
    Palo Alto Networks Discloses More Details on Critical PAN-OS Flaw Under Attack
    The Hacker News · News · Apr 20, 2024
  12. 12
    Palo Alto Networks Outlines Remediation for Critical PAN-OS Flaw Under Attack
    The Hacker News · News · Apr 26, 2024
  13. 13
    Palo Alto Networks firewalls under attack, hotfixes incoming! (CVE-2024-3400)
    Help Net Security · News · Apr 12, 2024
  14. 14
    CVE-2024-3400: Command Injection Vulnerability in Palo Alto Networks PAN-OS
    GreyNoise · Research · Apr 15, 2024
  15. 15
    CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
    Palo Alto Networks · Vendor · Apr 12, 2024
  16. 16
    Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400
    Palo Alto Networks Unit 42 · Research · Apr 12, 2024

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 16 sources, then checked against them by a separate review step on Oct 22, 2026.

Fixed builds and release dates were checked against Palo Alto's advisory and the CVE record on NVD.

Ransomware use has not been confirmed by CISA or the vendor, so it is left unset.

Spotted an error? Open an issue on sochub.io.