Palo Alto Networks patches zero-day affecting firewalls using GlobalProtect Portal VPN

Share on facebook
Share on twitter
Share on linkedin
Share on reddit
Share on email

Researchers with cybersecurity firm Randori have discovered a remote code execution vulnerability in Palo Alto Networks firewalls using the GlobalProtect Portal VPN. 

ZDNet Recommends

The zero-day — which has a severity rating of 9.8 — allows for unauthenticated, remote code execution on vulnerable installations of the product. 

The issue affects multiple versions of PAN-OS 8.1 prior to 8.1.17, and Randori said it found numerous vulnerable instances exposed on internet-facing assets, in excess of 70,000 assets. It is used by a number of Fortune 500 companies and other global enterprises.

Palo Alto has released an update that patches CVE-2021-3064 after being notified about the issue in September. 

Aaron Portnoy, principal scientist at Randori, told ZDNet that the original catalyst for their research into Palo Alto Networks firewalls was identifying its presence on customer perimeters.

“Once an attacker has control over the firewall, they will have visibility into the internal network and can proceed to move laterally. Randori

Read the article