GlobalProtect Clientless VPN: Clientless VPN Misconfiguration Allows Cross-Site Attacks

Palo Alto Networks GlobalProtect Clientless VPN is intended to provide secure remote access to trusted internal applications. It is not meant to provide access to the Internet, intranet or multiple websites. When the Clientless VPN is misconfigured to allow access to the Internet or any internal...

Informational: PAN-OS BIOS and Bootloader Security Bulletin

Palo Alto Networks is aware of claims of multiple vulnerabilities in hardware device firmware and bootloaders included in our PA-Series hardware firewalls. It is not possible for malicious actors or PAN-OS administrators to exploit these vulnerabilities under normal conditions on PAN-OS versions...

Expedition: Multiple Vulnerabilities in Expedition Migration Tool Lead to Exposure of Firewall Credentials

Multiple vulnerabilities in the Palo Alto Networks Expedition migration tool enable an attacker to read Expedition database contents and arbitrary files, as well as create and delete arbitrary files on the Expedition system. These files include information such as usernames, cleartext passwords,...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop10.html https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop18.html Work around: No workaround or...

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall t...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop19.html https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html Work around: No work around availabl...

GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation

An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificat...

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. This issue is applicable to PAN-OS 10.1, PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS...

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User

An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you...

PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic

A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulti...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into its products: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop15.html https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop22.html...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions ...

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface. Work aroun...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall. Work around: We strongly recommend customers to ensure access to your management interface is...

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet

A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service DoS condition. Repeated attempts ...

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service DoS condition. Repeated attempts to trigger this...

Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to Cortex XDR Agent. While Cortex XDR Agent may include the affected OSS package, Cortex XDR Agent does not offer any scenarios required for an attacker to successfully...

Informational Bulletin: Impact of OSS CVEs in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to PAN-OS software. While PAN-OS software may include the affected OSS package, PAN-OS does not offer any scenarios required for an attacker to successfully exploit thes...

Informational Bulletin: OSS CVEs fixed in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. Work around: TBD...

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator beyond what the XML API permits. Wo...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into its products: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop17.html - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop24.html -...

Expedition: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials

Multiple vulnerabilities in Palo Alto Networks Expedition allow an attacker to read Expedition database contents and arbitrary files, as well as write arbitrary files to temporary storage locations on the Expedition system. Combined, these include information such as usernames, cleartext password...

Cortex XSOAR: Information Disclosure Vulnerability

A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data. Work around: No work around available...

Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. Work...

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install...

PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service DoS condition. Repeated attempts to trigger this condition will result in PAN-OS entering...

Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176 in the Common UNIX Printing System CUPS as they relate to our products. Based on current information, Palo Alto Networks products and cloud services do not conta...

ActiveMQ Content Pack: Cleartext Exposure of Credentials

A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in log bundles. Work around: No work around available...

PAN-OS: User Impersonation in GlobalProtect Portal

A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from...

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstal...

PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface CLI enables authenticated administrators including read-only administrators with access to the CLI to to read arbitrary files on the firewall. Work around: No work around available...

Cortex XDR Agent: Local Windows Administrator Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. Work around:...

Prisma Browser: Monthly Vulnerability Updates

Prisma Browser has incorporated the latest upstream Chromium security fixes listed here: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop21.html - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html -...

PAN-OS: Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall. Work around: TBD...

Informational Bulletin: Impact of OSS CVEs in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to PAN-OS software. While PAN-OS software may include the affected OSS package, PAN-OS does not offer any scenarios required for an attacker to successfully exploit thes...

Informational Bulletin: Impact of OpenSSL Vulnerabilities CVE-2024-5535 and CVE-2024-6119

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-5535 and CVE-2024-6119 as they relate to our products. PAN-OS, Cloud NGFW, Prisma Access, and Cortex XDR Agent are not affected by CVE-2024-5535 or CVE-2024-6119. At present, no other Palo Alto Networks products are kno...

PAN-OS: Cleartext Exposure of External System Secrets

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to...

Cortex XSOAR: Command Injection in CommonScripts Pack

A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container. Work around: Remove any integration usage of the ScheduleGenericPolling or GenericPollingScheduledTask...

Prisma Browser: Monthly Vulnerability Updates

Prisma Browser supersedes Talon Browser has incorporated the latest upstream Chromium security fixes listed here: - https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html - https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop23.html -...

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A privilege escalation PE vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. Work around: Ensure that the GlobalProtect installation directory and its contents cannot be modified by non-administrative...

PAN-OS: CHAP and PAP When Used with RADIUS Authentication Lead to Privilege Escalation

This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to ‘superuser’ when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS serv...

Expedition: Missing Authentication Leads to Admin Account Takeover

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credential...

Cortex XDR Agent: Improper File Signature Verification Checks

An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked...

PAN-OS: File Upload Vulnerability in the Panorama Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

PAN-OS: Improper Input Validation Vulnerability in PAN-OS

An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges. Work around: No work around available...

Informational Bulletin: Expedition Installation Script Resets Root Password

A hardcoded password in the Palo Alto Networks Expedition VM installation script may allow remote attackers to elevate their privileges to root access on Expedition VMs that are running Expedition, if not changed as per the installation instructions. The updated version of the script no longer...

Informational Bulletin: Impact of OpenSSH regreSSHion Vulnerability

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-6387, known as "regreSSHion", as it relates to our products. The SSH features in PAN-OS are not affected by CVE-2024-6387. At present, no other Palo Alto Networks products are known to contain the vulnerable software...

GlobalProtect App: Encrypted Credential Exposure via Log Files

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting...