Palo Alto Networks has issued a critical security advisory regarding a potential remote code execution (RCE) vulnerability affecting the PAN-OS management interface of their next-generation firewalls.

The advisory, released on November 8, 2024, warns customers to restrict access to their firewall management interfaces due to this unconfirmed security threat.

However, the company strongly recommends that customers ensure their management interface access is configured correctly, following best practice deployment guidelines.

Shadowserver has conducted scans to identify exposed PAN-OS management interfaces. Alarmingly, approximately 11,000 IP addresses with exposed management interfaces have been discovered.

This significant number of potentially vulnerable systems underscores the urgency of implementing proper security measures.

Palo Alto Networks advises customers to limit access to the management interface to trusted internal IP addresses only and not expose it to the internet. The company believes that Prisma Access and cloud NGFW are unaffected by this potential vulnerability.

To mitigate the risk, administrators are encouraged to take several precautionary measures:

1. Isolate the management interface on a dedicated management VLAN
2. Use jump servers for accessing the management IP
3. Limit inbound IP addresses to approved management devices
4. Permit only secure communication protocols such as SSH and HTTPS
5. Allow PING solely for testing connectivity.

Customers using Cortex Xpanse and Cortex XSIAM with the ASM module can investigate internet-exposed instances by reviewing alerts generated by the Palo Alto Networks Firewall Admin Login attack surface rule.