CVE-2019-1579

nvd.nist.gov • July 9, 2026

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Resurgence of Exploitation Attempts on GlobalProtect and CitrixBleed Vulnerabilities Between June 29 and July 6, 2026, GreyNoise observed a significant increase in exploitation attempts targeting Palo Alto GlobalProtect CVE-2019-1579, with over 120 malicious hosts detected on July 6. This activity was primarily sourced from a single hosting network. Concurrently, GreyNoise documented active exploitation of CVE-2025-5777 (CitrixBleed 2), which began on June 23, 2026, prior to the public release of a proof-of-concept on July 4. The early exploitation of CVE-2025-5777 was traced back to malicious IPs in China, specifically targeting GreyNoise sensors emulating Citrix NetScaler appliances. CISA confirmed the exploitation of CVE-2025-5777 on July 9, 2026, adding it to the Known Exploited Vulnerabilities catalog. Organizations are advised to patch vulnerabilities and block malicious IPs to mitigate risks. 2 sources 75

Extracted Entities

CVE-2019-1579

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (2)