Palo Alto should owe you money when its own firewall lets ransomware in

On 13 May Palo Alto Networks told customers about an authentication bypass in the GlobalProtect portal and gateway of PAN-OS, scored it 4.7 on the CVSS scale, and shipped a patch. Four days later, according to Rapid7, attackers were already using it successfully. By early June ransomware crews including Qilin and Inc were working through it, ReliaQuest says Settra operators joined them, and Palo Alto's own Unit 42 now lists victims in a range of sectors running from education and healthcare to utilities and logistics.

I started this piece expecting a story about months of silent compromise before anyone was told. The timeline does not support that, and I would be lying if I said otherwise: the earliest reported exploitation came after the advisory. What I found instead annoyed me more. The failure sits in how Palo Alto priced the risk and how fast it updated customers. The bug was later rerated 7.8, high. Palo Alto's advisory update on 29 May spoke of "limited exploit attempts" on unpatched devices, 16 days after Rapid7 says successful exploitation began. CISA added it to its exploited-vulnerabilities catalogue the same day and gave federal civilian agencies three days to fix it.

That score matters commercially. Security teams triage by severity because they cannot patch everything at once. A medium on a VPN gateway sits in the queue behind whatever is marked high that week. The vendor sets the queue position, and when it sets it wrong, the customer carries the cost of the mistake. In any other supply relationship, a supplier that mislabelled a defect's severity and then took more than two weeks to admit it was being exploited would expect a call from legal.

Nor was this exotic. Arctic Wolf says vulnerable PAN-OS versions trusted any authentication override cookie they could decrypt without checking that the device had issued it. If the same certificate served the public HTTPS service and the cookie encryption, an attacker could forge a valid cookie for any user, administrators included. Picus files it under CWE-565, a long-catalogued class of flaw. Once inside, Unit 42 says attackers in one case went from the VPN gateway to vCenter, switched off ESXi controls and dumped domain credentials straight from a domain controller's virtual disk, out of reach of endpoint tools. Others chained the entry with the Veeam backup bug CVE-2023-27532. The customer pays for downtime, recovery and possibly a ransom. Palo Alto would not tell The Register how many organisations were hit.

The vendor's best defence is configuration. Exploitation needed GlobalProtect enabled, override cookies switched on, which is not the default, and a reused or exposed certificate. A patch existed from day one, and Panorama and Cloud NGFW were unaffected. I accept part of this. Customers who reused certificates made a choice, and customers who sat on a patch for weeks own that delay. But the override cookie was a feature Palo Alto built and offered, and a firewall that will accept forged administrator credentials under a supported setting has a product defect. More to the point, a contract can be written around the parts the vendor alone controls: the initial severity score, how fast it revises that score once exploitation starts, and how quickly it tells customers what it knows. None of those clauses depends on how a customer configured its gateway, and neither does the 16 days between Rapid7's first confirmed exploitation and Palo Alto's update.

There is also an incentive problem I cannot get past. Unit 42 is Palo Alto's consulting and incident response business, and it is Unit 42 writing up the attacks on Palo Alto's own operating system. I am not suggesting anyone wanted this to happen. I am saying that when the firewall fails, the company that sold the firewall is well placed to be in the room for the clean-up, and none of the loss lands on its income statement. I would like some of it to.

Procurement teams have more leverage here than they use, because firewall renewals are large, multi-year and painful to switch away from in both directions. At your next renewal, ask for three clauses: written notice within three days of the vendor learning of in-the-wild exploitation, the same window CISA gave federal agencies; a service credit whenever a vulnerability's severity is raised after exploitation is confirmed; and disclosure, on request, of how many customers a given bug has compromised. Before that renewal arrives, check this week whether authentication override cookies are enabled on your GlobalProtect gateways and whether that certificate also fronts your public portal. If your account rep refuses a three-day notice clause, put the refusal in writing and send it to whoever signs off the budget.

Prompted by Palo Alto's firewall OS has been under attack from multiple ransomware groups since June, theregister.