{"id":"CVE-2019-1579","aliases":["EUVD-2019-10136","GHSA-3w36-wf5x-rjfv"],"status":"published","title":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2...","description":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.44159,"percentile":0.98763,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-134"],"published":"2019-07-19T21:12:19Z","modified":"2026-10-02T04:18:01Z","kev":{"date_added":"2022-01-10","due_date":"2022-07-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-01-10"},{"source":"kev","since":"2022-01-10"}],"exploits":[{"source":"pocgithub","id":"securifera/CVE-2019-1579","title":"securifera/CVE-2019-1579","date":"2019-09-10","url":"https://github.com/securifera/CVE-2019-1579"},{"source":"pocgithub","id":"Elsfa7-110/CVE-2019-1579","title":"Elsfa7-110/CVE-2019-1579","date":"2020-10-21","url":"https://github.com/Elsfa7-110/CVE-2019-1579"}],"products":[{"vendor":"palo alto networks","product":"pan-os"},{"vendor":"paloaltonetworks","product":"pan-os"}],"references":[{"url":"http://www.securityfocus.com/bid/109310","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://security.paloaltonetworks.com/CVE-2019-1579","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1579"},{"url":"https://securityadvisories.paloaltonetworks.com/Home/Detail/158"},{"url":"https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study"},{"url":"https://github.com/advisories/GHSA-3w36-wf5x-rjfv"}],"sources":{"cve":[{"id":"CVE-2019-1579","description":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.","status":"published","published":"2019-07-19T21:12:19Z","modified":"2026-10-02T03:55:13.444Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:20:26.034547Z"}],"euvd":[{"id":"EUVD-2019-10136","description":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.","status":"published","published":"2019-07-19T21:12:19Z","modified":"2026-10-02T03:55:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-01-10","updated_at":"2026-11-02T17:27:43.593551Z"}],"ghsa":[{"id":"GHSA-3w36-wf5x-rjfv","title":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2...","description":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.","status":"published","published":"2022-05-24T16:50:47Z","modified":"2025-10-22T00:32:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-1579","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","description":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.","cwes":["CWE-134"],"kev":{"date_added":"2022-01-10","due_date":"2022-07-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-1579","description":"Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.","status":"published","published":"2019-07-19T22:15:11.557Z","modified":"2026-10-02T04:18:01.077Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:05:20.616405Z"}]}}