Palo Alto Networks has issued an urgent security warning regarding the exploitation of a critical remote command execution (RCE) vulnerability in the management interfaces of its firewall products.

This flaw, which allows unauthenticated attackers to execute arbitrary commands on affected systems, has been observed in a limited number of cases where firewall management interfaces are exposed to the Internet.

The company has raised the severity of the vulnerability to critical, with a CVSSv4.0 base score of 9.3, reflecting the high risk posed to organizations that have not followed recommended security practices.

Palo Alto Networks is actively investigating the issue and has confirmed that threat actors have already begun exploiting this vulnerability in the wild.

The vulnerability primarily affects firewall management interfaces that are accessible from the Internet. Palo Alto Networks strongly advises customers to immediately review their firewall configurations and ensure that access to these management interfaces is restricted to trusted internal IP addresses only, as per best practice guidelines.

The company emphasized that Prisma Access and Cloud NGFW services are not affected by this vulnerability, reducing concern for users of these products. However, for other firewall systems, Palo Alto Networks warns that failure to secure management interfaces could leave them vulnerable to attack.

“At this time, we believe devices whose access to the management interface is not secured as per our recommended best practice deployment guidelines are at increased risk,” the company stated in its advisory.

To assist customers in identifying potentially vulnerable devices, Palo Alto Networks has provided guidance through its Customer Support Portal. Users can follow these steps:

1. Visit the Assets section of the Customer Support Portal.
2. Locate devices tagged with PAN-SA-2024-0015, indicating those with Internet-facing management interfaces.

If no such devices are listed, it means Palo Alto’s scans did not detect any exposed interfaces for that account. However, customers are urged to double-check their configurations manually.

While active exploitation has been observed in a limited number of cases, Palo Alto Networks has not yet provided specific indicators of compromise (IoCs). Customers are advised to monitor for unusual activity such as unrecognised configuration changes or unfamiliar user logins.

As part of its ongoing response, Palo Alto Networks is preparing patches and threat prevention signatures to mitigate this vulnerability. These fixes are expected to be released soon.

In the meantime, securing access to firewall management interfaces remains the most effective defensive measure. The company will continue updating its advisory as new information becomes available.

For ongoing updates and notifications, customers can subscribe to Palo Alto Networks’ security RSS feed or email alerts via their support portal.