CVE-2019-1579

Palo Alto Networks GlobalProtect Portal/Gateway Interface

Published 19 Jul 2019 · updated 2 Oct 2026 · Analyzed

8.1 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Jan 2022, with a remediation deadline of 10 Jul 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

References

www.securityfocus.com/bid/109310 · Broken Link, Third Party Advisory, VDB Entry
devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/ · Exploit, Third Party Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 · Broken Link, Third Party Advisory
security.paloaltonetworks.com/CVE-2019-1579 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579 · US Government Resource