Palo Alto PAN-OS: Root on the Firewall Through GlobalProtect

PAN-OS is the operating system on Palo Alto Networks next-generation firewalls; GlobalProtect is its SSL/IPsec VPN portal and gateway for remote access. Two edge surfaces draw attacks: the internet-facing GlobalProtect portal and the PAN-OS management web interface. A root-level firewall compromise gives an attacker a trusted inspection and pivot point in the middle of the network. Two flaws stand out: the critical GlobalProtect command injection CVE-2024-3400 and the 2025 management-interface authentication bypass CVE-2025-0108.

Key Exploited CVEs

Both are CISA KEV-listed and confirmed exploited. Palo Alto reported attempts chaining CVE-2025-0108 with CVE-2024-9474 (privilege escalation) and CVE-2025-0111 (authenticated file read) against exposed management interfaces; confirm those chained IDs against the PAN-OS advisories. T1190 T1059

Who Exploited Them

• CVE-2024-3400: Volexity identified zero-day exploitation in April 2024 by an actor it tracks as UTA0218, assessed “highly likely” state-backed (a vendor assessment), which established a reverse shell and moved laterally; Palo Alto’s Unit 42 named the campaign Operation MidnightEclipse.
• CVE-2025-0108: GreyNoise observed mass opportunistic exploitation ramping within days of disclosure, consistent with scanning against a published proof-of-concept rather than a single named actor.

Detection & Mitigation

• Patch to the fixed PAN-OS releases immediately — both flaws are confirmed exploited.
• Remove the management web interface from internet exposure entirely, restricting it to a dedicated management network or jump host — the single highest-impact control for CVE-2025-0108 and the chained flaws.
• For CVE-2024-3400, note that Palo Alto’s early interim mitigations (such as disabling device telemetry) were later found ineffective — rely on the patch, not the original workaround.
• Where exploitation is suspected, review a Tech Support File per Palo Alto’s guidance, rotate all credentials and certificates on the device, and hunt for unexpected reverse-shell or outbound connections from the firewall.