“Tracked as CVE-2024-3400 and assigned a severity score of 10 out of 10, the security defect was identified in the GlobalProtect feature of PAN-OS”
An unauthenticated attacker gets root on the firewall, the box that exists to keep attackers out, and Volexity tied the attacks to a state-sponsored actor backdooring devices. Patches for PAN-OS 10.2, 11.0 and 11.1 arrive later in the week. Until then the mitigation goes to customers paying for a Threat Prevention subscription, and everyone else is told to switch off telemetry. Palo Alto ships the hole for free and charges for the plug.