iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On September 11, 2024, Palo Alto Networks announced fixes for vulnerabilities in PAN-OS, Cortex XDR, its ActiveMQ Content Pack, and Prisma Access Browser. The most serious issue highlighted in the report, CVE-2024-8686, allowed an authenticated PAN-OS administrator to bypass restrictions and run commands as root. The fixes below describe the September 2024 disclosure; administrators should check Palo Alto Networks’ live advisories for current upgrade targets before changing production systems.
Which products and vulnerabilities were covered?
The update spanned firewall software, endpoint protection, an integration content pack, and a browser. SecurityWeek described the collection as “dozens,” but its report and the associated vendor advisories do not establish one exact total across all products. The figure of 29 applies specifically to Chromium CVEs listed in the Prisma Browser bulletin, not to the entire update.
| Product or component | Issue described | September 2024 fix information |
|---|---|---|
| PAN-OS | Administrator command injection (CVE-2024-8686); arbitrary file reading by CLI administrators (CVE-2024-8688); GlobalProtect user impersonation (CVE-2024-8691) | Fixes varied by issue and PAN-OS release; see the version details below. |
| Cortex XSOAR and Cortex XSIAM ActiveMQ integration | Configured credentials could be exposed in log bundles (CVE-2024-8689) | ActiveMQ Content Pack 1.1.15 and later. |
| Cortex XDR Agent for Windows | A local Windows administrator could disable the agent (CVE-2024-8690). | Cortex XDR Agent 8.2 and later. |
| Prisma Access Browser, called Prisma Browser in the vendor bulletin | 29 Chromium CVEs listed in the bulletin. | Prisma Browser 128.138.2888.2 and later contains the listed fixes. |
What did each PAN-OS vulnerability allow?
CVE-2024-8686: administrator command injection
Palo Alto Networks described an authenticated administrator bypassing system restrictions to run arbitrary commands as root on a firewall. The advisory lists PAN-OS 11.2.2 as affected and 11.2.3 and later as fixed. SecurityWeek singled this out as the update’s most important issue based on its high severity. Palo Alto Networks said it was not aware of malicious exploitation of this vulnerability at disclosure.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCVE-2024-8688: arbitrary file reading through the CLI
An authenticated administrator with CLI access—including a read-only administrator—could read arbitrary firewall files. The vendor advisory lists fixes including PAN-OS 9.1.15, 10.0.10, and 10.1.1, with later versions also fixed. Palo Alto Networks said it knew of no malicious exploitation at the time.
#1 Best Overall
CVE-2024-8691: GlobalProtect user impersonation
An authenticated GlobalProtect user could impersonate another user. The victim might be disconnected, and logs could record the victim’s identity instead of the attacker’s. Listed fixes include PAN-OS 9.1.17 and 10.1.11, with later versions also fixed.
What were the Cortex and ActiveMQ issues?
CVE-2024-8689: ActiveMQ credentials in log bundles
The ActiveMQ integration for Cortex XSOAR and Cortex XSIAM could expose configured credentials in log bundles. Content Pack 1.1.15 and later fixes the issue. Palo Alto Networks advised upgrading before using new ActiveMQ credentials and revoking the credentials that had already been configured.
CVE-2024-8690: disabling the Windows Cortex XDR Agent
A local Windows administrator could disable the Cortex XDR Agent, which malware could potentially leverage. The vendor lists Cortex XDR Agent 8.2 and later as fixed and said it knew of no malicious exploitation at disclosure.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
What did the Prisma Browser bulletin cover?
The separate PAN-SA-2024-0009 bulletin lists 29 Chromium CVEs across browser update builds and says Prisma Browser 128.138.2888.2 and later includes fixes for all the CVEs in that bulletin. Some listed entries have no CVSS score displayed. SecurityWeek noted that some Chromium issues incorporated by the browser update had been exploited in the wild. That is distinct from Palo Alto Networks’ statement that it was not aware of in-the-wild exploitation of the vulnerabilities specific to its products.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should administrators use the version information?
- Identify deployed products and releases. Check the PAN-OS release on each firewall, plus the installed Cortex XDR Agent, ActiveMQ Content Pack, and Prisma Browser versions where applicable.
- Match each affected component to its advisory. The historical fixes differ by product and, for PAN-OS, by vulnerability and release branch. Do not assume that one PAN-OS target fixes every listed issue.
- Consult the current vendor advisory before upgrading. The listed versions are September 2024 publication details, not a guarantee that they are the right target today. Confirm current supported versions and the organization’s deployment requirements in Palo Alto Networks’ live advisories.
- For the ActiveMQ integration, handle credentials as well as software. Upgrade to a fixed Content Pack before introducing new credentials, then revoke the previously configured credentials as the vendor recommends.
A separate September 4, 2024 Palo Alto Networks bulletin assessed other open-source CVEs and said they did not affect PAN-OS, so no update was required for those issues. They are not part of the vulnerabilities patched in the September 11 update.
Quick Recap
Sources
- SecurityWeek: Palo Alto Networks Patches Dozens of Vulnerabilities
- Palo Alto Networks advisory for CVE-2024-8686
- Palo Alto Networks security advisories
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
