Shakedown Social

Tod BeardsleySo here's a dumb question. Does CVE-2025-33053 actually affect Apache <a href="https://infosec.exchange/tags/mod_dav" class="mention hashtag" rel="nofollow noopener" target="_blank">#mod_dav</a> after all?<a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> seems to be implying this: "This vulnerability could affect various products that implement WebDAV, including but not limited to Microsoft Windows."Like, is it a protocol bug, or a product bug? The <a href="https://www.cve.org/cverecord?id=CVE-2025-33053" rel="nofollow noopener" target="_blank">CVE</a> only lists Microsoft products as affected.

Tod Beardsley<a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> added the Erlang/OTP and RoundCube bugs to the <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> today.<a href="https://infosec.exchange/@runZeroInc" class="u-url mention" rel="nofollow noopener" target="_blank">@runZeroInc</a> already has queries for both of these -- the Erlang/OTP one since April. rZ users should be well ahead of this today.<a href="https://www.runzero.com/blog/erlang-otp-ssh/" rel="nofollow noopener" translate="no" target="_blank">https://www.runzero.com/blog/erlang-otp-ssh/</a><a href="https://www.runzero.com/blog/roundcube-webmail/" rel="nofollow noopener" translate="no" target="_blank">https://www.runzero.com/blog/roundcube-webmail/</a>

Tod Beardsley<a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> posts up a passel of new KEVs, completely blowing through the k-rad 1337 count.Technically, it looks like CVE-2025-32709 is the winrar of Most LEET Bug on <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a>.

Tod Beardsley<a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> adds CVE-2025-47729 to the <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> -- which is for the crazy hacked up version of Signal used by high-ranking US government officials.Wowzo. That's something.<a href="https://www.cve.org/CVERecord?id=CVE-2025-47729" rel="nofollow noopener" translate="no" target="_blank">https://www.cve.org/CVERecord?id=CVE-2025-47729</a>

Tod Beardsley<a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> ends RSS for <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a>. Sigh.UPDATE: No they didn't! H/t <a href="https://infosec.exchange/@ntkramer" class="u-url mention" rel="nofollow noopener" target="_blank">@ntkramer</a> "Update May 13: In an effort to enhance user experience and highlight the most timely and actionable information for cyber defenders, CISA announced a shift in how we share cybersecurity alerts and advisories. We recognize this has caused some confusion in the cyber community. As such, we have paused immediate changes while we re-assess the best approach to sharing with our stakeholders."<a href="https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications" rel="nofollow noopener" translate="no" target="_blank">https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications</a>

mauvehed 🐿️ (KØMVH)I wrote a Discord bot to monitor for CVEs being mentioned in chat, and then it will fetch the details and post it back to chat.It also has a feature to monitor for new KEV notifications and send them to a dedicated channelCollab with me. Use it. Abuse it. What ever ya want!<a href="https://github.com/mauvehed/kevvy" rel="nofollow noopener" translate="no" target="_blank">https://github.com/mauvehed/kevvy</a><a href="https://defcon.social/tags/CVSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVSS</a> <a href="https://defcon.social/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a> <a href="https://defcon.social/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://defcon.social/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://defcon.social/tags/Vulnerabilties" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerabilties</a> <a href="https://defcon.social/tags/Discord" class="mention hashtag" rel="nofollow noopener" target="_blank">#Discord</a>

CybersecKyleCISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation <a href="https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html" rel="nofollow noopener" translate="no" target="_blank">https://thehackernews.com/2025/02/cisa-adds-microsoft-and-zimbra-flaws-to.html</a><a href="https://infosec.exchange/tags/cybersec" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a>

John LeonardCISA adds critical Mitel and Oracle vulnerabilities to exploited listExploitation could allow attackers to gain unauthorised access to an organisation's entire unified communications infrastructure<a href="https://www.computing.co.uk/news/2025/security/cisa-adds-critical-mitel-and-oracle-vulnerabilities-to-exploited-list" rel="nofollow noopener" translate="no" target="_blank">https://www.computing.co.uk/news/2025/security/cisa-adds-critical-mitel-and-oracle-vulnerabilities-to-exploited-list</a><a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://mastodon.social/tags/cybcersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybcersecurity</a> <a href="https://mastodon.social/tags/technews" class="mention hashtag" rel="nofollow noopener" target="_blank">#technews</a> <a href="https://mastodon.social/tags/mitel" class="mention hashtag" rel="nofollow noopener" target="_blank">#mitel</a> <a href="https://mastodon.social/tags/oracle" class="mention hashtag" rel="nofollow noopener" target="_blank">#oracle</a> <a href="https://mastodon.social/tags/cisa" class="mention hashtag" rel="nofollow noopener" target="_blank">#cisa</a> <a href="https://mastodon.social/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a>

Wade BakerICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): <a href="https://www.cyentia.com/epss-study/" rel="nofollow noopener" translate="no" target="_blank">https://www.cyentia.com/epss-study/</a><a href="https://infosec.exchange/tags/vulnerabilitymanagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilitymanagement</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilities</a> <a href="https://infosec.exchange/tags/vulnerability_exploits" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability_exploits</a> <a href="https://infosec.exchange/tags/exploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#exploit</a> <a href="https://infosec.exchange/tags/exploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#exploitation</a> <a href="https://infosec.exchange/tags/cyberattack" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberattack</a> <a href="https://infosec.exchange/tags/cyberattacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberattacks</a> <a href="https://infosec.exchange/tags/epss" class="mention hashtag" rel="nofollow noopener" target="_blank">#epss</a> <a href="https://infosec.exchange/tags/cvss" class="mention hashtag" rel="nofollow noopener" target="_blank">#cvss</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a>

Not SimonwatchTowr may have successfully replicated CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 by Palo Alto Networks as an exploited zero-day, CWE-77: Command Injection; OS Command Injection Vulnerability in GlobalProtect Gateway, added to CISA KEV Catalog). Instead of releasing a Proof of Concept, they provided a "detection artefact generator tool" 🔗 <a href="https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/" rel="nofollow noopener" translate="no" target="_blank">https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/</a><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a>

Not Simon<a href="https://infosec.exchange/@jullrich" class="u-url mention" rel="nofollow noopener" target="_blank">@jullrich</a> of SANS ISC warns that the widely shared GitHub exploit is almost certainly fake (cc: <a href="https://infosec.town/@mttaggart" class="u-url mention" rel="nofollow noopener" target="_blank">@mttaggart</a> ) and two IP addresses were attempting CVE-2024-3400 exploitation: <code>173.255.223.159</code> and <code>146.70.192.174</code> 🔗 <a href="https://isc.sans.edu/diary/rss/30838" rel="nofollow noopener" translate="no" target="_blank">https://isc.sans.edu/diary/rss/30838</a><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a>

Not SimonHappy hotfix day from Palo Alto Networks who released 3 hotfixes for CVE-2024-3400 (10.0 critical, disclosed 12 April 2024 as an exploited zero-day) with 15 more hotfixes expected in the coming days: 🔗 <a href="https://security.paloaltonetworks.com/CVE-2024-3400" rel="nofollow noopener" translate="no" target="_blank">https://security.paloaltonetworks.com/CVE-2024-3400</a><ul><li>PAN-OS 10.2:<ul><li>10.2.9-h1 (Released 14 April)</li><li>10.2.8-h3 (ETA: 15 April)</li><li>10.2.7-h8 (ETA: 15 April)</li><li>10.2.6-h3 (ETA: 15 April)</li><li>10.2.5-h6 (ETA: 16 April)</li><li>10.2.3-h13 (ETA: 17 April)</li><li>10.2.1-h2 (ETA: 17 April)</li><li>10.2.2-h5 (ETA: 18 April)</li><li>10.2.0-h3 (ETA: 18 April)</li><li>10.2.4-h16 (ETA: 19 April)</li></ul></li><li>PAN-OS 11.0:<ul><li>11.0.4-h1 (Released 14 April)</li><li>11.0.3-h10 (ETA: 15 April)</li><li>11.0.2-h4 (ETA: 16 April)</li><li>11.0.1-h4 (ETA: 17 April)</li><li>11.0.0-h3 (ETA: 18 April)</li></ul></li><li>PAN-OS 11.1:<ul><li>11.1.2-h3 (Released 14 April)</li><li>11.1.1-h1 (ETA: 16 April)</li><li>11.1.0-h3 (ETA: 17 April)</li></ul></li></ul><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a>

Not SimonIt should come as no surprise that Palo Alto Networks did not release hotfixes* for affected versions of PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11 by the self-imposed deadline of Sunday 14 April 2024 like they estimated in their security advisory. 48 hours to develop/test/release is a tight delivery window with the whole infosec community breathing down their necks.<a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a>

Not SimonCISA put out an additional security alert about CVE-2024-3400, noting that Palo Alto Networks released workaround guidance for the command injection vulnerability. 🔗 <a href="https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400" rel="nofollow noopener" translate="no" target="_blank">https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400</a><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a>

Not SimonJust to make it easier to read through the various reports (saying almost the same exact thing), I've assembled a Palo Alto Networks zero-day MEGA list:<ul><li>Palo Alto Networks security advisory: <a href="https://security.paloaltonetworks.com/CVE-2024-3400" rel="nofollow noopener" target="_blank">CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway</a></li></ul>UPDATE: Volexity and Unit 42 talk about the threat actor, campaign, and include indicators of compromise:<ul><li>Volexity: <a href="https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400" rel="nofollow noopener" target="_blank">Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)</a></li><li>Unit 42: <a href="https://unit42.paloaltonetworks.com/cve-2024-3400/" rel="nofollow noopener" target="_blank">Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400</a></li></ul>Here's the rest of the related reporting:<ul><li>Zscaler: <a href="https://www.zscaler.com/blogs/security-research/another-cve-pan-os-zero-day-another-reason-consider-zero-trust-0" rel="nofollow noopener" target="_blank">Another CVE (PAN-OS Zero Day), Another Reason to Consider Zero Trust</a></li><li>The Register: <a href="https://www.theregister.com/2024/04/12/palo_alto_pan_flaw/" rel="nofollow noopener" target="_blank">Zero-day exploited right now in Palo Alto Networks' GlobalProtect gateways</a></li><li>Bleeping Computer: <ol><li><a href="https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-firewall-zero-day-used-in-attacks/" rel="nofollow noopener" target="_blank">Palo Alto Networks warns of PAN-OS firewall zero-day used in attacks</a></li><li>(update) <a href="https://www.bleepingcomputer.com/news/security/palo-alto-networks-zero-day-exploited-since-march-to-backdoor-firewalls/" rel="nofollow noopener" target="_blank">Palo Alto Networks zero-day exploited since March to backdoor firewalls</a></li></ol></li><li>SANS ISC: <a href="https://isc.sans.edu/diary/rss/30834" rel="nofollow noopener" target="_blank">Critical Palo Alto GlobalProtect Vulnerability Exploited (CVE-2024-3400)</a></li><li>CERT-EU: <a href="https://cert.europa.eu/publications/security-advisories/2024-037/" rel="nofollow noopener" target="_blank">Critical Vulnerability in PAN-OS software</a></li><li>Qualys: <a href="https://threatprotect.qualys.com/2024/04/12/pan-os-os-command-injection-vulnerability-exploited-in-the-wild-cve-2024-3400/" rel="nofollow noopener" target="_blank">PAN-OS OS Command Injection Vulnerability Exploited in the Wild (CVE-2024-3400)</a></li><li>Rapid7: <a href="https://www.rapid7.com/blog/post/2024/04/12/etr-cve-2024-3400-critical-command-injection-vulnerability-in-palo-alto-networks-firewalls-2/" rel="nofollow noopener" target="_blank">CVE-2024-3400: Critical Command Injection Vulnerability in Palo Alto Networks Firewalls</a></li><li>The Hacker News: <ol><li><a href="https://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html" rel="nofollow noopener" target="_blank">Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack</a></li><li>(update) <a href="https://thehackernews.com/2024/04/hackers-deploy-python-backdoor-in-palo.html" rel="nofollow noopener" target="_blank">Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack</a></li></ol></li><li>Security Week: <ol><li><a href="https://www.securityweek.com/palo-alto-networks-warns-of-exploited-firewall-vulnerability/" rel="nofollow noopener" target="_blank">Palo Alto Networks Warns of Exploited Firewall Vulnerability</a></li><li>(update) <a href="https://www.securityweek.com/state-sponsored-hackers-exploit-zero-day-to-backdoor-palo-alto-networks-firewalls/" rel="nofollow noopener" target="_blank">State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls</a></li></ol></li><li>SOCRadar: <a href="https://socradar.io/critical-os-command-injection-vulnerability-in-palo-altos-globalprotect-gateway-cve-2024-3400-the-patch-is-not-available-yet/" rel="nofollow noopener" target="_blank">Critical OS Command Injection Vulnerability in Palo Alto's GlobalProtect Gateway: CVE-2024-3400. The patch is not available yet.</a></li><li>CISA: <ol><li><a href="https://www.cisa.gov/news-events/alerts/2024/04/12/cisa-adds-one-known-exploited-vulnerability-catalog" rel="nofollow noopener" target="_blank">CISA Adds One Known Exploited Vulnerability to Catalog</a></li><li><a href="https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400" rel="nofollow noopener" target="_blank">Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400</a></li></ol></li><li>The Record: <a href="https://therecord.media/vpn-zero-day-palo-alto-networks" rel="nofollow noopener" target="_blank">Palo Alto Networks warns of zero-day in VPN product</a></li><li>Ars Technica:<a href="https://arstechnica.com/security/2024/04/highly-capable-hackers-root-corporate-networks-by-exploiting-firewall-0-day/" rel="nofollow noopener" target="_blank">“Highly capable” hackers root corporate networks by exploiting firewall 0-day</a></li></ul><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a>

Not SimonHot off the press! CISA adds CVE-2024-3400 (10.0 critical, disclosed 12 April 2024, PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway) to the Known Exploited Vulnerabilities (KEV) Catalog 🔗 (to be updated later) <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" rel="nofollow noopener" translate="no" target="_blank">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a><a href="https://infosec.exchange/tags/CVE_2024_3400" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_3400</a> <a href="https://infosec.exchange/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaloAltoNetworks</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/kev" class="mention hashtag" rel="nofollow noopener" target="_blank">#kev</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a>

Not SimonIvanti has a frequently asked questions (FAQ) blog post from 14 February 2024 addressing questions about their Ivanti Connect Secure, Policy Secure and ZTA gateway products. Important to note that "As of 14 February, Ivanti has a build available for all supported versions." It also responds to Eclypsium's claim of old open source code. They also dispute reporting that CVE-2024-22024 (8.3. high, disclosed 12 February by Ivanti) was being exploited after disclosure. "It is unfortunate that media reports continue to cover statements and unverified numbers from third parties that are incorrect or inflated." Ivanti officially responds to the accusations that they didn't credit watchTowr for reporting CVE-2024-22024. This reads like damage control for Ivanti's Public Relations. 🔗 <a href="https://www.ivanti.com/blog/key-faqs-related-to-ivanti-connect-secure-policy-secure-and-zta-gateway-vulnerabilities" rel="nofollow noopener" translate="no" target="_blank">https://www.ivanti.com/blog/key-faqs-related-to-ivanti-connect-secure-policy-secure-and-zta-gateway-vulnerabilities</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/UTA0178" class="mention hashtag" rel="nofollow noopener" target="_blank">#UTA0178</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/CVE_2024_21888" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21888</a> <a href="https://infosec.exchange/tags/CVE_2024_21893" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21893</a> <a href="https://infosec.exchange/tags/CVE_2024_22024" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_22024</a>

Not SimonIvanti updated their knowledge base article with an available patch: <blockquote>Update 1 February: A patch addressing all known vulnerabilities is now available for Ivanti Connect Secure version 22.5R2.2 and Ivanti Policy Secure 22.5R1.1. </blockquote><a href="https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US" rel="nofollow noopener" translate="no" target="_blank">https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/UTA0178" class="mention hashtag" rel="nofollow noopener" target="_blank">#UTA0178</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/CVE_2024_21888" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21888</a> <a href="https://infosec.exchange/tags/CVE_2024_21893" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21893</a>

Not SimonIvanti identified two new vulnerabilities (one actively exploited) in connection to the Ivanti Connect Secure zero-days from 10 January 2024. They are:<ul><li>CVE-2024-21888 (8.8 high) privilege escalation in web component "We have no evidence of customers being impacted by CVE-2024-21888 at this time"</li><li>CVE-2024-21893 (8.2 high, exploited in the wild) sever side request forgery (SSRF) in the SAML component "At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted"</li></ul>A patch is now available for Ivanti Connect Secure (versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1) and ZTA version 22.6R1.3. 🔗 <a href="https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US" rel="nofollow noopener" translate="no" target="_blank">https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US</a> blog post: <a href="https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways" rel="nofollow noopener" translate="no" target="_blank">https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways</a> security advisory: <a href="https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US" rel="nofollow noopener" translate="no" target="_blank">https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/UTA0178" class="mention hashtag" rel="nofollow noopener" target="_blank">#UTA0178</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/CVE_2024_21888" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21888</a> <a href="https://infosec.exchange/tags/CVE_2024_21893" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21893</a>

Not SimonJust your periodic update from Ivanti regarding their CVE-2023-46805 (8.2 high) and CVE-2024-21887 (9.1 critical) zero-days (both disclosed 10 January 2024 as exploited in the wild, has Proofs of Concept, mass exploitation):"Update 26 January: The targeted release of patches for supported versions is delayed, this delay impacts all subsequent planned patch releases. We are now targeting next week to release a patch for Ivanti Connect Secure (versions 9.1R17x, 9.1R18x, 22.4R2x and 22.5R1.1), Ivanti Policy Secure (versions 9.1R17x, 9.1R18x and 22.5R1x) and ZTA version 22.6R1x. Patches for supported versions will still be released on a staggered schedule. Instructions on how to upgrade to a supported version will also be provided. The timing of patch release is subject to change as we prioritize the security and quality of each release. Please ensure you are following this article to receive updates as they become available." 🔗 <a href="https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US" rel="nofollow noopener" translate="no" target="_blank">https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/UTA0178" class="mention hashtag" rel="nofollow noopener" target="_blank">#UTA0178</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/KnownExploitedVulnerabilitiesCatalog" class="mention hashtag" rel="nofollow noopener" target="_blank">#KnownExploitedVulnerabilitiesCatalog</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a>

Recent searches

Search options

Administered by:

Server stats:

#Kev