Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

On April 10, 2024, Volexity identified zero-day exploitation of a vulnerability found within the GlobalProtect feature of Palo Alto Networks PAN-OS at one of its network security monitoring (NSM) customers. Volexity received alerts regarding suspect network traffic emanating from the customer’s firewall. A subsequent investigation determined the device had been compromised. The following day, April 11, 2024, Volexity observed further, identical exploitation at another one of its NSM customers by the same threat actor.

Volexity would like to thank Palo …

alerts alto april code code execution customer customers cve cve-2024 cve-2024-3400 device exploitation feature firewall found globalprotect investigation monitoring network networks network security network security monitoring network traffic nsm palo palo alto palo alto networks palo alto networks pan-os pan pan-os remote code remote code execution security security monitoring traffic unauthenticated volexity vulnerability zero-day