CVE-2019-1579

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
n/a	Palo Alto Networks GlobalProtect Portal/Gateway Interface	PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2 and earlier releases

References

http://www.securityfocus.com/bid/109310Broken Link, Third Party Advisory, VDB Entry
https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/Exploit, Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010Broken Link, Third Party Advisory
https://security.paloaltonetworks.com/CVE-2019-1579Vendor Advisory
http://www.securityfocus.com/bid/109310Broken Link, Third Party Advisory, VDB Entry
https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/Exploit, Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010Broken Link, Third Party Advisory
https://security.paloaltonetworks.com/CVE-2019-1579Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579US Government Resource

Timeline

Published: Jul 19, 2019
Last modified: Oct 2, 2026
Added to CISA KEV: Jan 10, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-157903.3Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashe CVE-2019-157917.8In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() inst CVE-2019-157927.8In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() call CVE-2019-157938.8In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids tra CVE-2019-157946.7Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both r CVE-2019-157954.7python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in versio CVE-2019-157964.7Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archi CVE-2019-157998.8An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the CVE-2019-15809.8Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow CVE-2019-158009.8An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_tracerou CVE-2019-158017.5An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that ar CVE-2019-158025.9An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hard