Follow-Up: Arctic Wolf Observes Ongoing Exploitation of Critical Palo Alto Networks Vulnerability CVE-2024-0012 Chained with CVE-2024-9474

Arctic Wolf reports active exploitation of PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474; when chained, these allow an unauthenticated attacker with access to the management web interface to gain administrator/root privileges. Exploitation has been observed in customer environments with attempts to transfer tools and exfiltrate configuration files; a public PoC was released on 2024-11-19, increasing the risk. The advisory lists affected PAN-OS and Panorama/WildFire versions, provides fixed versions to upgrade to, and recommends removing devices from internet exposure, restricting management access (e.g., jump boxes, IP whitelists), and contacting Palo Alto for Enhanced Factory Reset if compromise is confirmed.