Palo Alto GlobalProtect CVE-2019-1579: another VPN gateway, another pre-auth RCE
CVE-2019-1579 was a pre-authentication remote code execution in Palo Alto's GlobalProtect SSL-VPN. It's one more entry in the longest-running story in this catalog: the SSL-VPN gateway as a perennial, pre-auth-RCE-prone perimeter target.
CVE-2019-1579 is a pre-authentication remote code execution flaw in Palo Alto Networks’ GlobalProtect portal and gateway, the SSL-VPN component of PAN-OS. A format-string bug in how the gateway handled a request parameter let an unauthenticated attacker who could reach the GlobalProtect interface execute code on the firewall. It belongs to the single most repeated story in the Known Exploited Vulnerabilities catalog: the SSL-VPN gateway as a perennial, pre-auth-RCE-prone perimeter target, the same lane as Citrix NetScaler, Pulse/Ivanti Connect Secure, Fortinet FortiOS, and SonicWall.
What it is
The bug was disclosed in mid-2019 by Orange Tsai and Meh Chang as part of their research into SSL-VPN appliances (the same research that surfaced major Pulse Secure and Fortinet bugs). Palo Alto patched it across affected PAN-OS versions. CISA lists it with the ransomware flag, and it drew APT interest given how valuable a firewall foothold is. The impact is the familiar one: code execution on the device that guards remote access, a position to intercept traffic, harvest credentials, and pivot inward.
The lesson, one more time
There isn’t a novel lesson in CVE-2019-1579 so much as the reinforcement of the catalog’s loudest one: every major SSL-VPN vendor has shipped pre-authentication RCE or auth-bypass bugs, repeatedly, and these gateways are the most consistently-exploited class of device there is. Internet-facing by definition, holding the keys to remote access, running complex web code, they are exactly what both ransomware crews and nation-states hunt. The defensive posture is the same across all of them:
- Patch perimeter VPN/firewall gear on an emergency cadence. The disclosure-to-exploitation window for these is days.
- Minimize what the gateway exposes, and keep management interfaces off the internet entirely.
- Enforce MFA on remote access, which raises the bar even when an auth bypass or RCE is in play (and is essential against the credential attacks that hit these constantly).
- Assume compromise and hunt for implants after any exposure window; rotate the secrets the device held.
- Keep current with the vendor’s advisories, because there will be a next one.
What to do
- Patch PAN-OS to a fixed version for CVE-2019-1579 and stay current. If you somehow still run an affected, internet-facing GlobalProtect, treat it as urgent.
- Lock down GlobalProtect and the management plane per Palo Alto hardening guidance.
- Investigate long-exposed, unpatched gateways for code execution and post-exploitation, and rotate credentials and keys.
The reframe is to stop treating each SSL-VPN RCE as news and treat the gateway as what it demonstrably is: a permanent, top-priority target with a track record across every vendor. CVE-2019-1579 is one Palo Alto entry in that long ledger. Patch perimeter gear fast, shrink its exposure, enforce MFA, and assume the next gateway bug is coming, because it always is. We track the SSL-VPN entries as one continuous story spanning every vendor, because the attackers do too.
Sources
Share
Related field notes
-
Shitrix: the Citrix bug that taught everyone how fast a perimeter RCE goes from PoC to pandemic
CVE-2019-19781, 'Shitrix,' was a path-traversal RCE in Citrix NetScaler. After disclosure with no patch, a public exploit dropped and mass exploitation followed within days. It set the template for the NetScaler-as-target story that CitrixBleed later continued.
-
Fortinet's other products take their turn: FortiWeb, FortiManager, FortiClient EMS
Beyond the long-running FortiOS auth-bypass cycle, 2025-2026 brought a wave of exploited bugs in FortiWeb, FortiManager, and FortiClient EMS, SQL injection, path traversal, auth bypass, and a format-string RCE. Same vendor, same perimeter-and-management target profile.
-
They read one file off the VPN gateway and left with your whole Active Directory
CVE-2024-24919 is filed as 'information disclosure.' On a Check Point gateway that meant unauthenticated file read, which meant password hashes, which meant ntds.dit within hours. It was a zero-day for a month before disclosure, and patching it doesn't undo the theft.
One email, every weekday morning.
You're in. Check your inbox.