Is my Palo Alto GlobalProtect VPN a risk?
It was, badly, in April 2024.
Last read from the sources at the foot of this page.
What is GlobalProtect?
GlobalProtect is the VPN built into Palo Alto Networks firewalls. Its portal and gateway answer on the internet so staff can connect.
Why does it matter?
Palo Alto Networks PAN-OS Command Injection Vulnerability 2024-04-12 Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
CISA added the flaw to its catalog of exploited flaws on 12 April 2024. CISA says it lets an unauthenticated attacker run commands with root privileges on the firewall.
Did turning off telemetry protect the firewall?
On April 17, 2024, Palo Alto Networks updated their security advisory Footnote 1 to reflect that having device telemetry disabled does NOT protect PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway and/or GlobalProtect portal from exploitation.
No. Canada's Cyber Centre reported on 17 April 2024 that Palo Alto Networks changed its advice: having device telemetry disabled does NOT protect affected firewalls. The hotfix was the answer.
What do I do about it?
- Keep PAN-OS on a supported, fixed release.
- Turn on multi-factor sign-in for GlobalProtect.
- Keep the firewall's management page off the internet.
- Watch Palo Alto's security advisories for new GlobalProtect fixes.
Where does this come from?
- CISA: Known Exploited Vulnerabilities catalog, CVE-2024-3400cisa.govRead 14 October 2026
- Canadian Centre for Cyber Security: Alert AL24-005, PAN-OS GlobalProtectcyber.gc.caRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/