Palo Alto Networks has disclosed a critical remote code execution vulnerability in PAN-OS that is actively being exploited in the wild. The unpatched flaw affects the User-ID Authentication Portal.
Palo Alto Networks alerted customers to a critical-severity zero-day vulnerability in its PAN-OS User-ID Authentication Portal that threat actors are actively exploiting in targeted attacks.
The vulnerability allows unauthenticated attackers to execute arbitrary code remotely on affected devices. Users of the authentication portal feature in PAN-OS deployments are at immediate risk.
Palo Alto Networks has not released patches as of the warning date. The company advised customers to implement mitigations immediately, including disabling the User-ID Authentication Portal if it is not required, or restricting network access to trusted sources only.
The company is working on fixes and has not disclosed specific version numbers affected, though it typically impacts multiple PAN-OS releases. Organizations running vulnerable configurations should prioritize this threat in their patching schedules.
This marks another critical vulnerability in enterprise security infrastructure. Palo Alto Networks firewalls are widely deployed across organizations globally, making zero-day flaws in these systems particularly concerning for IT teams. The active exploitation means attackers have already developed working exploits.
Organizations should review their PAN-OS deployments immediately to determine if they use the User-ID Authentication Portal feature. Those that do should implement the recommended mitigations without delay. Palo Alto Networks will provide updates as patches become available.
Customers are advised to monitor Palo Alto Networks' security advisories and apply updates as soon as they are released. In the interim, network segmentation and access controls are essential defensive measures.
Visa is enabling expired payment cards to continue processing contactless transactions through a new feature. The move allows cardholders to keep using their old cards for tap-to-pay purchases even after expiration.
A Texas-based student discovered and reported an unauthorized AI system being used for cyberattacks. The disclosure prompted immediate investigation and security responses from affected organizations.
Iranian cyber actors shut down a small UK power generation facility for four days, according to sources cited by The Telegraph. The incident coincides with a broader wave of attacks targeting US water utilities attributed to Iran-affiliated groups.
A supply-chain attack is exploiting legitimate device-update apps to infect Android-based car head units with malware. The compromised devices are being enlisted into proxy botnets or used for ad fraud schemes.