Monday Briefing: Active exploits target Palo Alto GlobalProtect and Check Point VPN gateways
Marcus Webb ·
Attackers are actively exploiting critical flaws in Palo Alto Networks GlobalProtect portals and Check Point Remote Access VPN gateways, and intrusion reports continue into Monday. The targets are internet-facing appliances across North America and Europe, and the goal is rapid initial access that leads to credential theft, lateral movement, and in some cases ransomware deployment.
This matters now because both vulnerabilities are on CISA’s Known Exploited Vulnerabilities list and remain exposed in many environments. Successful exploitation of these devices often results in domain compromise within hours if not contained.
Edge device exploits top Monday risk
CVE-2024-3400 is a command injection bug in PAN-OS when GlobalProtect is enabled. Volexity reported in-the-wild exploitation in April 2024 by a suspected China-nexus actor it tracks as UTA0218, and defenders have since linked the flaw to follow-on data theft and backdoor deployment. Palo Alto released fixed PAN-OS builds, and customers should upgrade to the latest supported versions and restrict GlobalProtect exposure where possible.
CVE-2024-24919 is an information disclosure flaw affecting Check Point Security Gateways with Remote Access VPN. Threat actors have used it to read sensitive files and harvest credentials for VPN and Active Directory, then create or reuse accounts for persistent access. Check Point issued patches and guidance to disable unused local accounts, enforce MFA, rotate potentially exposed credentials, and review VPN logs for anomalous logins by new or dormant users.
OpenSSH servers also warrant attention. CVE-2024-6387, known as regreSSHion, reintroduced a signal handler race condition that enables unauthenticated remote code execution on some Linux distributions. While reliable exploitation has constraints, opportunistic scanning and exploit attempts were observed after disclosure, and teams should update OpenSSH to 9.8p1 or later and apply connection rate limiting.
What defenders should do now
Inventory and patch or mitigate all internet-facing GlobalProtect and Check Point VPN gateways first. If patch windows are constrained, apply vendor mitigations, enable MFA on remote access, and monitor for newly created admin users, suspicious cron or scheduled tasks, and unusual processes on appliances.
Hunt for indicators tied to prior exploitation, including unexpected configuration changes, unknown VPN users, and outbound connections from firewalls or gateways. Isolate compromised edge devices, rotate credentials captured on or accessible from those systems, and review domain controllers for evidence of lateral movement.
The broader takeaway for 2026 is that edge appliances remain high-value targets and a short path to full compromise. Enterprises that treat these devices as untrusted endpoints, limit their exposed services, and apply rapid patching and robust authentication controls reduce the blast radius when the next appliance vulnerability moves from disclosure to active exploit.