InfoSecBulletin Cybersecurity for mankind
“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet. We are actively investigating this activity,” reads the security bulletin by the cybersecurity provider Palo Alto Networks.
On November 8, Palo Alto issued a security advisory about a zero-day vulnerability in certain PAN-OS firewall management interfaces. The vulnerability is an unauthenticated remote code execution (RCE) flaw in the internet management interfaces of next-generation firewalls (NGFWs) that are exposed online.
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
CVSS Score of 9.3:
Palo Alto considers it a critical vulnerability with a CVSS score of 9.3. The vulnerability only impacts public-facing management interfaces of NGFWs. The manufacturer asserts that Prisma Access and Cloud NGFW are not affected.
“If the management interface access is restricted to IPs, the risk of exploitation is greatly limited, as any potential attack would first require privileged access to those IPs. CVSS for this scenario is 7.5 High,” added the company.
Palo Alto initially reported no threat related to the new vulnerability, but updated its advisory on November 14 to confirm it has been exploited in the wild.
Palo Alto Working on a Patch:
Palo Alto notified customers that it is working on updates to protect against threats, which will be available soon.
“We strongly recommend customers to ensure access to your management interface is configured correctly in accordance with our recommended best practice deployment guidelines,” Palo Alto added in its advisory.
This comes only days after the US Cybersecurity and Infrastructure Security Agency (CISA) added another vulnerability affecting a Palo Alto product – this time Palo Alto Expedition (CVE-2024-5910) – to its Known Exploited Vulnerability (KEV) catalog.
