Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

HIGH 8.1EXPLOITED (CISA KEV)CVE-2019-1579 · Published 19/07/2019 · updated 02/10/2026

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
PAN-OS Palo Alto Networks	Versions not published yet (product named by CISA KEV)

Description

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

References

securityfocus.com/bid/109310 · Broken Link
devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study · Exploit
psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Broken Link
security.paloaltonetworks.com/CVE-2019-1579 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-1579

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free