Palo Alto Security Updates – 10 October 2024

The addressed vulnerabilities could allow the attacker to gain elevated privileges, perform denial of service attacks, conduct reflected XSS attacks, obtain sensitive information, bypass security restrictions or execute arbitrary commands, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Unauthenticated OS Command Injection Vulnerability (CVE-2024-9463):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. PAN-OS Firewall Denial of Service (DoS) via Maliciously Crafted Packet Vulnerability (CVE-2024-9468):

• CVSS: 8.2
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

The affected products:

• PAN-OS.
• Cortex XSOAR.
• Cortex XDR.
• GlobalProtect App.