PAN-OS GlobalProtect Endpoint Probe (CVE-2024-3400) for 2026-10-19
Last Updated: 00:00 UTC
CVE-2024-3400 is a command injection in Palo Alto PAN-OS GlobalProtect (CVSS 10.0) allowing unauthenticated RCE via the prelogin endpoint. Exploitation was observed in the wild before the patch was available. Scanners probe /global-protect/prelogin.esp and /login.esp to fingerprint GlobalProtect gateways prior to exploitation.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| United States | 10 | 40.0% |
| United Kingdom | 5 | 20.0% |
| Sweden | 3 | 12.0% |
| Panama | 1 | 4.0% |
| South Africa | 1 | 4.0% |
| Seychelles | 1 | 4.0% |
| Latvia | 1 | 4.0% |
| Turkmenistan | 1 | 4.0% |
| Russia | 1 | 4.0% |
| Bulgaria | 1 | 4.0% |
IP Address : ASN : City/Provider
-
13.40.3.63 : AS16509 Amazon.com, Inc. : City of London
-
141.98.82.26 : AS209588 Flyservers S.A. : Panama
-
157.230.170.244 : AS14061 DigitalOcean, LLC : Santa Clara
-
165.227.84.181 : AS14061 DigitalOcean, LLC : North Bergen
-
170.187.145.88 : AS63949 Akamai Connected Cloud : Atlanta
-
173.255.221.224 : AS63949 Akamai Connected Cloud : Fremont
-
18.133.226.109 : AS16509 Amazon.com, Inc. : City of London
-
18.135.102.137 : AS16509 Amazon.com, Inc. : City of London
-
18.169.157.250 : AS16509 Amazon.com, Inc. : City of London
-
192.142.226.23 : AS399138 Microlink Network : South Africa
-
196.251.86.39 : unknown : Seychelles
-
198.167.197.162 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.194 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.204 : AS39287 Materialism s.r.l. : Sweden
-
23.239.29.116 : AS63949 Akamai Connected Cloud : Richardson
-
3.237.171.239 : AS14618 Amazon.com, Inc. : Ashburn
-
3.237.171.92 : AS14618 Amazon.com, Inc. : Ashburn
-
3.238.40.160 : AS14618 Amazon.com, Inc. : Ashburn
-
3.8.211.191 : AS16509 Amazon.com, Inc. : City of London
-
44.200.226.159 : AS14618 Amazon.com, Inc. : Ashburn
-
44.211.86.191 : AS14618 Amazon.com, Inc. : Ashburn
-
86.54.25.160 : AS210006 Shereverov Marat Ahmedovich : Latvia
-
91.202.233.8 : AS200593 Prospero Ooo : Ashgabat
-
91.215.85.104 : AS200593 Prospero Ooo : Russia
-
93.123.118.208 : AS209630 LLC Vash Kredit Bank : Bulgaria