# CVE-2019-1579

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

- Page: https://www.vulneraibility.com/cve/CVE-2019-1579
- CVSS: 8.1
- Known exploited: yes, in CISA KEV since 2022-01-10; CISA due date 2022-07-10; known ransomware use
- EPSS: 44.16% (percentile 98.8)
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept (first 2019-09-10)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2022-01-06)
- Weakness: CWE-134
- Published: 2019-07-19

## Affected versions

- Palo Alto Networks GlobalProtect Portal/Gateway Interface: affected PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and  PAN-OS 8.1.2  and earlier releases

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] http://www.securityfocus.com/bid/109310
- [other] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
- [other] https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/
- [other] https://security.paloaltonetworks.com/CVE-2019-1579
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.