[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/bola-vulnerabilities-easyappointments/) * [Japanese](https://unit42.paloaltonetworks.com/ja/bola-vulnerabilities-easyappointments/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/ "Vulnerabilities") [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) # AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/product-category/cortex-xpanse/ "Cortex Xpanse")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ravid Mazon](https://unit42.paloaltonetworks.com/author/ravid-mazon/) * [Jay Chen](https://unit42.paloaltonetworks.com/author/jay-chen/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:July 25, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/) * [BOLA](https://unit42.paloaltonetworks.com/tag/bola/) * [CVE-2023-3285](https://unit42.paloaltonetworks.com/tag/cve-2023-3285/) * [CVE-2023-3290](https://unit42.paloaltonetworks.com/tag/cve-2023-3290/) * [CVE-2023-38047](https://unit42.paloaltonetworks.com/tag/cve-2023-38047/) * [CVE-2023-38055](https://unit42.paloaltonetworks.com/tag/cve-2023-38055/) * [Easy!Appointments](https://unit42.paloaltonetworks.com/tag/easyappointments/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/bola-vulnerabilities-easyappointments/?pdf=download&lg=en&_wpnonce=48697d1bdd "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/bola-vulnerabilities-easyappointments/?pdf=print&lg=en&_wpnonce=48697d1bdd "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=AI%20Tool%20Identifies%20BOLA%20Vulnerabilities%20in%20Easy!Appointments&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F&title=AI%20Tool%20Identifies%20BOLA%20Vulnerabilities%20in%20Easy!Appointments "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F&text=AI%20Tool%20Identifies%20BOLA%20Vulnerabilities%20in%20Easy!Appointments "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=AI%20Tool%20Identifies%20BOLA%20Vulnerabilities%20in%20Easy!Appointments%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbola-vulnerabilities-easyappointments%2F "Share in Mastodon") ## Executive Summary Palo Alto Networks has been actively researching and developing security capabilities using [AI](https://www.paloaltonetworks.com/precision-ai-security). In an effort to audit web applications for Broken Object-Level Authorization (BOLA) vulnerabilities, Unit 42 researchers developed an automated BOLA detection tool leveraging GenAI. In 2023, we used our tool to test an open-source project,[Easy!Appointments](https://easyappointments.org/), and found 15 BOLA vulnerabilities. We notified the vendor, who has since patched the vulnerabilities. The number of issues we found highlights the prevalence of BOLA vulnerabilities in API applications and underscores the importance of continuously scrutinizing software for these potentially severe issues. Easy!Appointments is a popular tool used for scheduling and managing appointments, as well as synchronizing data with widely used calendar services. The vulnerabilities we discovered allow low-privileged and logged in users (such as customers) to view and manipulate appointments created by more privileged users (such as providers and admins). The vulnerabilities we discovered, tracked as[CVE-2023-3285](https://www.cve.org/CVERecord?id=CVE-2023-3285) to[CVE-2023-3290](https://www.cve.org/CVERecord?id=CVE-2023-3290) and[CVE-2023-38047](https://www.cve.org/CVERecord?id=CVE-2023-38047) to[CVE-2023-38055](https://www.cve.org/CVERecord?id=CVE-2023-38055), all affect different API endpoints. They have been assigned CVSS scores ranging from 5 to 9.9, with seven vulnerabilities scoring 9.9. Upon discovering these vulnerabilities, we collaborated closely with the maintainers to patch all the issues in the latest version 1.5.0. To mitigate the risks, organizations are advised to upgrade to Easy!Appointments version 1.5.0 or later immediately. Please reach out to info@easyappointments.org for more information on updating to the latest version. [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) and [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) customers with the ASM module are able to detect all exposed Easy!Appointments instances as well as known insecure instances via targeted attack surface rules. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**API Attacks**](https://unit42.paloaltonetworks.com/tag/api-attacks/), **[BOLA](https://unit42.paloaltonetworks.com/tag/bola/)** | |----------------------------|------------------------------------------------------------------------------------------------------------------------------------| ## **Broken Object-Level Authorization (BOLA)** Broken object-level authorization (BOLA), also known as insecure direct object references (IDOR), is a prevalent type of vulnerability in modern APIs and web applications. It is ranked as the top risk in the [OWASP API top 10](https://owasp.org/API-Security/editions/2023/en/0x11-t10/) and the fourth most reported vulnerability type in the [HackerOne Global Top 10](https://www.hackerone.com/vulnerability-management/hackerone-global-top-10-hacker-expertise-industry-data-and-date). As explained in another [recent article on a BOLA vulnerability](https://unit42.paloaltonetworks.com/new-bola-vulnerability-grafana/), BOLA occurs when an application fails to properly check if a user has the necessary permissions to access, modify or delete an object. The term object in this context refers to various types of data within a system, examples of which include messages, photos, trips, user profiles and invoices. Attackers can exploit BOLA vulnerabilities in API endpoints by altering object identifiers within requests. Such manipulations can lead to unauthorized access to user data, resulting in data leaks, manipulation of data or even complete account takeovers. ## BOLA Detection While manually looking for BOLAs is generally straightforward, automating this process is challenging. Testing for BOLA has historically been performed manually due to the complexity of web applications' workflow and business logic, along with the stateful nature of modern web applications. Researchers at Palo Alto Networks are actively developing new technology that leverages AI to automate the detection of BOLA vulnerabilities. We're internally using these AI detection operations to allow us to test new advancements daily. Our most recent disclosed vulnerability was [CVE-2024-1313](https://grafana.com/security/security-advisories/cve-2024-1313/), a [BOLA vulnerability in Grafana](https://unit42.paloaltonetworks.com/new-bola-vulnerability-grafana/?), an open-source project with over 20 million users. ## Overview of Easy!Appointments [Easy!Appointments](https://github.com/alextselegidis/easyappointments) is an open-source web application designed for scheduling appointments. It is highly customizable, allowing integration with existing websites and synchronization with Google Calendar and CalDAV servers. The software is free and supports commercial use, targeting professional users through premium services. It is popular among large organizations and a committed developer community maintains it. Easy!Appointments features a [permissions system](https://easyappointments.org/2021/06/14/user-roles-and-permissions-explained/) for different user roles. Every role except admin is considered low-privileged. * **Customer**: This role can only access the booking page to manage their appointments. * **Provider**: This role manages appointments and customer information but cannot handle administrative tasks like managing services or system settings. * **Secretary**: This role is similar to providers but doesn't serve appointments directly. It manages schedules for assigned providers without accessing administrative settings. * **Admin**: This role has full access to all system resources and actions, including service definitions, user management and system settings. ## Explanation of Vulnerabilities This section outlines the 15 vulnerable API paths uncovered in our research. Most of these vulnerabilities are exploitable through APIs, not UI consoles. Each path may be vulnerable to one or multiple HTTP methods, such as GET, POST, PUT and DELETE. The lack of sufficient checking and validation of caller identities at the backend makes most API endpoints vulnerable to BOLA. Among the 15 CVEs identified, nine are rated as Critical severity (CVSS 9.0 or higher), five as High severity (CVSS between 7.0-9.0), and one as Medium severity (CVSS between 4.0-6.9). * **CVE-2023-3287 (CVSS=9.9)** : A BOLA vulnerability in POST /admins allows a low-privileged user to create a high-privileged user (admin) in the system. This results in privilege escalation. * **CVE-2023-38048 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low-privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38049 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low-privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38050 (CVSS=9.1)** : A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low-privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38051 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low-privileged user to fetch, modify or delete a low-privileged user (secretary). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38052 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low-privileged user to fetch, modify or delete a high-privileged user (admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38053 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low-privileged user to fetch, modify or delete the settings of any user (including admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38054 (CVSS=9.9)** : A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low-privileged user to fetch, modify or delete a low-privileged user (customer). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-38055 (CVSS=9.6)** : A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low-privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-3285 (CVSS=7.7)** : A BOLA vulnerability in POST /appointments allows a low-privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation. * **CVE-2023-3286 (CVSS=7.7)** : A BOLA vulnerability in POST /secretaries allows a low-privileged user to create a low-privileged user (secretary) in the system. This results in unauthorized data manipulation. * **CVE-2023-3288 (CVSS=7.7)** : A BOLA vulnerability in POST /providers allows a low-privileged user to create a privileged user (provider) in the system. This results in privilege escalation. * **CVE-2023-3289 (CVSS=7.7)** : A BOLA vulnerability in POST /services allows a low-privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation. * **CVE-2023-38047 (CVSS=8.5)** : A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low-privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation. * **CVE-2023-3290 (CVSS=5)** : A BOLA vulnerability in POST /customers allows a low-privileged user to create a low-privileged user (customer) in the system. This results in unauthorized data manipulation. **CVE-2023-38049** To illustrate the issue that underpins the vulnerabilities we identified, let's look at CVE-2023-38049 as an example. A user with a **secretary** role could exploit the vulnerability to modify an arbitrary user's appointment. According to the [official documentation](https://easyappointments.org/2021/06/14/user-roles-and-permissions-explained/), the secretary role is intended to perform organizational tasks only for their assigned providers. In particular, a malicious secretary could perform GET, PUT and DELETE operations on the API path /appointments/{appointmentId}*to modify another user's appointment.* It is important to note that these operations cannot be performed by a secretary through the user interface. They can only be executed via API calls. This results in a discrepancy between the API and UI behavior. We created an admin user and used it to create an appointment with appointment\_id equal to 1. Figure 1 shows the response of GET /appointments/1 request. The response includes information such as the following: * Appointment ID * Start and end times * Location * Customer * Provider * Service * Hash This data is sensitive and should only be accessible to the user who created the meeting. ![Screenshot of a web interface displaying API settings. The main panel shows JSON data with fields like "id", "start", "end", "book", "hash", "location", "serviceId", "providerId", and "customerId". The method is set to GET.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-729213-135834-1.png) Figure 1. An admin's appointment data. We then used a low-privileged secretary user to manipulate the appointment created by the admin user through the vulnerable endpoint, PUT /appointments/{appointmentId}. Figure 2 shows the HTTP requests sent with the secretary user. ![A screenshot of a software interface displaying a PUT request in an API testing tool. The request includes various parameters like appointment date, location, and customer details in JSON format, with a response code 200 OK shown at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-731671-135834-2.png) Figure 2. A low-privileged user manipulating admin's appointment. ## Vulnerability Impact Figure 3 shows the appointment being modified with different start and end times, location, and identities of the provider and customer. Despite these changes, the appointment hash remained unchanged, giving the false impression that the original appointment was not altered. ![Alt Text: Screenshot of a JSON response in an API testing interface. The response includes various fields such as "id", "book", "start", "end", "hash", "location", "notes", "customerId", "providerId", and "serviceId". Notable fields are highlighted, including the "start" and "end" times of an appointment, and the "notes" field labeled as a malicious appointment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/word-image-734457-135834-3.png) Figure 3. The "new," manipulated appointment. ## Disclosure Process * **Aug. 23, 2023**: We reported the vulnerabilities to Easy!Appointments' maintainers through email * **Oct. 9, 2023**: Easy!Appointments' maintainer confirmed the vulnerabilities * **April 24, 2024**: Unit 42 researchers sent a follow-up email to the maintainer to inquire about the patch release timeline * **May 6, 2024**: 15 CVEs were reserved * **May 14, 2024** : Easy!Appointments released version *1.5.0-alpha.1* (*develop*) that patched all the vulnerabilities * **July 1, 2024** : Easy!Appointments released version *1.5.0-beta.1* (*develop*) that patched all the vulnerabilities * **July 7, 2024** : Easy!Appointments released version *1.5.0 (production)* that patched all the vulnerabilities ## Conclusion As the use of APIs is increasing exponentially, so is the prevalence of API vulnerabilities and BOLA vulnerabilities in particular. This article details the 15 BOLA vulnerabilities Unit 42 researchers discovered in [Easy!Appointments](https://github.com/alextselegidis/easyappointments) using a new automatic methodology that leverages AI. Due to the ease of exploitation and potential impacts of these vulnerabilities, we encourage affected organizations to update to the patched version as soon as possible. Researchers at Unit 42 are committed to fortifying open-source software and innovating technology to discover new vulnerabilities more efficiently and effectively. Palo Alto Networks customers are better protected by our latest research findings and insights. [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) and [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) customers with the ASM module are able to detect all exposed Easy!Appointments instances as well as known insecure instances via targeted attack surface rules. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Back to top ### Tags * [API attacks](https://unit42.paloaltonetworks.com/tag/api-attacks/ "API attacks") * [BOLA](https://unit42.paloaltonetworks.com/tag/bola/ "BOLA") * [CVE-2023-3285](https://unit42.paloaltonetworks.com/tag/cve-2023-3285/ "CVE-2023-3285") * [CVE-2023-3290](https://unit42.paloaltonetworks.com/tag/cve-2023-3290/ "CVE-2023-3290") * [CVE-2023-38047](https://unit42.paloaltonetworks.com/tag/cve-2023-38047/ "CVE-2023-38047") * [CVE-2023-38055](https://unit42.paloaltonetworks.com/tag/cve-2023-38055/ "CVE-2023-38055") * [Easy!Appointments](https://unit42.paloaltonetworks.com/tag/easyappointments/ "Easy!Appointments") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Accelerating Analysis When It Matters](https://unit42.paloaltonetworks.com/accelerating-malware-analysis/ "Accelerating Analysis When It Matters") ### Table of Contents * ### Related Articles * [Threat Brief: Widespread Impact of the Axios Supply Chain Attack](https://unit42.paloaltonetworks.com/axios-supply-chain-attack/ "article - table of contents") * [AI Agents Are Here. So Are the Threats.](https://unit42.paloaltonetworks.com/agentic-ai-threats/ "article - table of contents") * [Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration](https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/ "article - table of contents") ## Related Vulnerabilities Resources ![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") * [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software") ![Pictorial representation of AI-enabled autonomous cyberattacks. A digital illustration depicting abstract, interconnected data streams in vibrant colors on a dark blue background](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-782x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 30, 2026 [#### Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) * [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT") * [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code") * [CVEs](https://unit42.paloaltonetworks.com/tag/cves/ "CVEs") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks") ![Pictorial representation of three zero-day vulnerabilities in Siemens ROX II OT switches. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 17, 2026 [#### Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/) * [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection") * [CVE-2025-40947](https://unit42.paloaltonetworks.com/tag/cve-2025-40947/ "CVE-2025-40947") * [CVE-2025-40948](https://unit42.paloaltonetworks.com/tag/cve-2025-40948/ "CVE-2025-40948") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy") ![Pictorial representation of PAN-OS CVE-2026-0257. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) June 9, 2026 [#### Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) * [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257") * [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257") ![Pictorial representation of CVE-2026-30300. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Vulnerabilities_1920x900-3-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 6, 2026 [#### Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/) * [CVE-2026-0300](https://unit42.paloaltonetworks.com/tag/cve-2026-0300/ "CVE-2026-0300") * [EarthWorm](https://unit42.paloaltonetworks.com/tag/earthworm/ "EarthWorm") * [PAN-OS](https://unit42.paloaltonetworks.com/tag/pan-os/ "PAN-OS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution") ![Pictorial representation of a severe Linux vulnerability. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 5, 2026 [#### Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/) * [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers") * [CVE-2026-31431](https://unit42.paloaltonetworks.com/tag/cve-2026-31431/ "CVE-2026-31431") * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years") ![Pictorial representation of CVE-2023-33538. Abstract image of a glowing red Wi-Fi symbol on a circuit board, with intricate patterns and a futuristic appearance.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/04_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 16, 2026 [#### A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/) * [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet") * [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection") * [CVE-2023-33538](https://unit42.paloaltonetworks.com/tag/cve-2023-33538/ "CVE-2023-33538") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "A Deep Dive Into Attempted Exploitation of CVE-2023-33538") ![Pictorial representation of BeyondTrust vulnerability CVE-2026-1731. Digital art depicting a stylized mountain range with vibrant blue and red hues. The peaks are accentuated by glowing particles and an abstract, starry backdrop, creating a futuristic landscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/14_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 19, 2026 [#### VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/) * [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash") * [CVE-2026-1731](https://unit42.paloaltonetworks.com/tag/cve-2026-1731/ "CVE-2026-1731") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)") ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/AdobeStock_1020436911-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 17, 2026 [#### Critical Vulnerabilities in Ivanti EPMM Exploited](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/) * [CVE-2026-1281](https://unit42.paloaltonetworks.com/tag/cve-2026-1281/ "CVE-2026-1281") * [CVE-2026-1340](https://unit42.paloaltonetworks.com/tag/cve-2026-1340/ "CVE-2026-1340") * [Ivanti](https://unit42.paloaltonetworks.com/tag/ivanti/ "Ivanti") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/ "Critical Vulnerabilities in Ivanti EPMM Exploited") ![Pictorial representation of CVE-2025-0921. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/06_Vulnerabilities_1920x900-2-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 30, 2026 [#### Privileged File System Vulnerability Present in a SCADA System](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/) * [CVE-2025-0921](https://unit42.paloaltonetworks.com/tag/cve-2025-0921/ "CVE-2025-0921") * [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/ "privilege escalation") * [SCADA](https://unit42.paloaltonetworks.com/tag/scada/ "SCADA") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ "Privileged File System Vulnerability Present in a SCADA System") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)