Palo Alto Networks Patches Actively Exploited Critical Zero-Day Vulnerability in GlobalProtect VPN

Palo Alto Networks has released an urgent patch for a critical zero-day vulnerability in its GlobalProtect VPN product. The flaw, tracked as CVE-2024-3400 (CVSS score of 10/10), resulting from a command injection issue, allows unauthenticated attackers to execute arbitrary code with root privileges. Hotfixes have been released for various versions of PAN-OS software, with additional patches forthcoming. The vulnerability, actively exploited since at least March 26, 2024, enables attackers to deploy the Python-based backdoor “UPSTYLE,” facilitating arbitrary command execution and lateral movement across networks. This severe security risk primarily affects configurations with the GlobalProtect gateway or portal, and device telemetry enabled. The exploitation has prompted rapid response actions including the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandating Federal Civilian Executive Branch (FCEB) agencies to implement the mitigations by no later than April 19, 2024. Palo Alto’s updates and advisories highlight the escalating challenges and risks associated with securing VPN products in an era of widespread remote work. CTIX analysts recommend all administrators ensure that they have installed the latest patches and have added the recommended defense-in-depth countermeasures to prevent future exploitation.