CVE-2019-1579

HIGH KEV RANSOMWARE

PAN-OS <7.1.18, <8.0.11-h1, <8.1.2 - RCE

Title source: llm

Description

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Exploits (2)

nomisec WORKING POC 63 stars

by securifera · remote

https://github.com/securifera/CVE-2019-1579

View Code ZIP pw:eip

nomisec SCANNER

by Elsfa7-110 · infoleak

https://github.com/Elsfa7-110/CVE-2019-1579

View Code ZIP pw:eip

References (5)

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/109310

[Exploit, Third Party Advisory] https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/

[Broken Link, Third Party Advisory] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010

[Vendor Advisory] https://security.paloaltonetworks.com/CVE-2019-1579

[US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579

Scores

CVSS v3 8.1

EPSS 0.9290

EPSS Percentile 99.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2022-01-10

VulnCheck KEV 2019-10-02

InTheWild.io 2019-12-02

ENISA EUVD EUVD-2019-10136

Ransomware Use Confirmed

CWE

CWE-134

Status published

Products (1)

paloaltonetworks/pan-os < 7.1.19

Published Jul 19, 2019

KEV Added Jan 10, 2022

Tracked Since Feb 18, 2026