Palo Alto Networks PAN-OS GlobalProtect CVE-2024-3400 (unauthenticated command injection leading to root RCE, exploited as a zero-day, CISA KEV): which firewalls and hotfixes are affected and how do I check for compromise?

What it is: CVE-2024-3400 is a critical (CVSS 10.0) flaw in the GlobalProtect feature of PAN-OS that lets an unauthenticated attacker run code with root privileges on the firewall. Palo Alto Networks published its advisory on April 12, 2024, after Volexity found it being used in the wild. It was added to CISA's KEV catalog the same day, and CISA lists it as used in ransomware campaigns. Palo Alto reported growing attack volume and publicly available attack tooling after disclosure. Am I affected: - PAN-OS 10.2, 11.0 and 11.1 firewalls with a GlobalProtect gateway or portal configured. Enabling device telemetry was never a prerequisite. - Not affected per the vendor: Prisma Access, Cloud NGFW, Panorama. - Check Device > Setup or the CLI (show system info) for the PAN-OS version, and Network > GlobalProtect for configured portals or gateways. Fix: 1. Upgrade to a fixed hotfix: 10.2.9-h1, 10.2.8-h3, 10.2.7-h8, 10.2.6-h3, 10.2.5-h6, 10.2.4-h16, 10.2.3-h13, 10.2.2-h5, 10.2.1-h2, 10.2.0-h3; 11.0.4-h1, 11.0.3-h10, 11.0.2-h4, 11.0.1-h4, 11.0.0-h3; 11.1.2-h3, 11.1.1-h1, 11.1.0-h3. Then move to a current maintenance release on your train. Azure marketplace builds use a slightly different version naming; follow the advisory's table. 2. If you cannot patch immediately and have a Threat Prevention subscription, enable the vendor's Threat IDs 95187, 95189 and 95191 (with vulnerability protection applied to the GlobalProtect interface). Palo Alto says this is not a substitute for upgrading, and disabling telemetry is no longer an accepted mitigation. 3. Check for compromise: Palo Alto's guidance is to review the GlobalProtect service log for session-handling error entries whose content looks like file paths or shell commands rather than a normal identifier, and to open a support case so they can check logs. Collect a Tech Support File before upgrading or rebooting, because the upgrade can make older logs unavailable. 4. If there are signs of compromise, follow the vendor's incident guidance (up to an enhanced factory reset arranged through support), restore a known-good configuration, and rotate credentials, keys and certificates that were on or reachable from the firewall, including VPN, LDAP and service-account secrets. Verify: the firewall reports a fixed hotfix version, vulnerability protection is applied to the GlobalProtect interface if you used signatures as a stopgap, and logs show no suspicious entries. Sources: https://security.paloaltonetworks.com/CVE-2024-3400 https://nvd.nist.gov/vuln/detail/CVE-2024-3400 https://www.cisa.gov/known-exploited-vulnerabilities-catalog