Hackers Actively Probe Palo Alto PAN-OS GlobalProtect Vulnerability for Exploitation

An uptick in internet-wide scanning indicates that threat actors are actively probing for systems vulnerable to CVE-2024-3400, a critical GlobalProtect flaw in Palo Alto Networks PAN-OS, according to SANS ISC. The researchers observed a single source IP, 141.98.82[.]26, targeting the GlobalProtect portal’s file-upload endpoint in an attempt to place and retrieve session files on firewalls.

Exploitation involves posting to /ssl-vpn/hipreport[.]esp with a manipulated session ID to create a file in the GlobalProtect directory, followed by a GET request for that file’s path which returns a 403 to signal the file exists but does not execute code. The CVE is described as Arbitrary file creation leading to OS command injection, with a CVSS 4.0 score of 10.0, affecting PAN-OS 10.2, 11.0, and 11.1 when configured with a GlobalProtect portal or gateway; Cloud NGFW, Panorama and Prisma Access are unaffected.

Palo Alto Networks has released fixes in PAN-OS 10.2.9-h1, 11.0.4-h1, and 11.1.2-h3, and administrators are urged to upgrade immediately, with threat prevention signatures 95187, 95189 and 95191 available to block exploit attempts, per the article dated 30 September 2025. According to the report, there has been no widespread, confirmed in-the-wild attacks beyond PoC exploits, but defenders should monitor for anomalous POST or GET requests to hipreport[.]esp and /global-protect/portal/images/.