CVE-2019-1579: PAN-OS GlobalProtect pre-auth remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE on an edge firewall that is in CISA KEV with known ransomware use and very high EPSS.

What it is

PAN-OS versions 7.1.18, 8.0.11-h1 and 8.1.2 and earlier contain a remote code execution flaw (CWE-134, format string) that is reachable when the GlobalProtect Portal or Gateway interface is enabled. An unauthenticated remote attacker can execute arbitrary code on the firewall, which sits at the network edge and is a high-value target. The record does not describe the exact vulnerable code path beyond the format string classification.

Impact

Successful exploitation gives the attacker arbitrary code execution on the PAN-OS device, typically at high privilege, allowing full compromise of the firewall and any traffic or credentials it handles. Because the device is an edge security control, compromise can expose the internal network.

Attack surface

Reachable over the network via the GlobalProtect Portal or Gateway interface when that service is enabled; the CVSS vector shows no privileges and no user interaction required. Only internet-exposed or otherwise reachable GlobalProtect interfaces are at risk.

Exploitation

CVE-2019-1579 is listed in CISA KEV with known ransomware campaign use, and EPSS is 0.46 (98.7th percentile), indicating active exploitation is expected. A public exploit write-up is referenced, so weaponized code is available.

What to do

• Upgrade PAN-OS to a fixed release per the Palo Alto Networks advisory; 7.1.18, 8.0.11-h1 and 8.1.2 and earlier are affected.
• If patching cannot be done immediately, disable the GlobalProtect Portal and Gateway interfaces or restrict access to them to trusted sources.
• Place GlobalProtect interfaces behind access controls and monitor for anomalous requests to those endpoints.
• Treat any internet-facing PAN-OS device running an affected version as potentially compromised and review it for signs of intrusion.
• Track CISA KEV remediation due date (2022-07-10) and confirm closure.

Detection

• Review PAN-OS and GlobalProtect logs for unexpected process execution, crashes or restarts on the firewall.
• Monitor for unusual outbound connections or new listening services originating from the firewall itself.
• Hunt for exploitation attempts against GlobalProtect endpoints in web or proxy logs, including malformed requests.
• Check for unauthorized configuration changes, new admin accounts or persistence on PAN-OS devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.