[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/zero-day-vulnerabilities-affect-cisco-software/) * [Japanese](https://unit42.paloaltonetworks.com/ja/zero-day-vulnerabilities-affect-cisco-software/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Insights](https://unit42.paloaltonetworks.com/category/insights/ "Insights") * [General](https://unit42.paloaltonetworks.com/category/general/ "General") [General](https://unit42.paloaltonetworks.com/category/general/) # Threat Insights: Active Exploitation of Cisco ASA Zero Days ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 6 min read Related Products [![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Andy Piazza](https://unit42.paloaltonetworks.com/author/andy-piazza/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:September 26, 2025 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [General](https://unit42.paloaltonetworks.com/category/general/) * [Insights](https://unit42.paloaltonetworks.com/category/insights/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Cisco](https://unit42.paloaltonetworks.com/tag/cisco/) * [CVE-2025-20333](https://unit42.paloaltonetworks.com/tag/cve-2025-20333/) * [CVE-2025-20362](https://unit42.paloaltonetworks.com/tag/cve-2025-20362/) * [CVE-2025-20363](https://unit42.paloaltonetworks.com/tag/cve-2025-20363/) * [Zero-day](https://unit42.paloaltonetworks.com/tag/zero-day/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/zero-day-vulnerabilities-affect-cisco-software/?pdf=download&lg=en&_wpnonce=f6e4b1f2e6 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/zero-day-vulnerabilities-affect-cisco-software/?pdf=print&lg=en&_wpnonce=f6e4b1f2e6 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Threat%20Insights:%20Active%20Exploitation%20of%20Cisco%20ASA%20Zero%20Days&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F&title=Threat%20Insights:%20Active%20Exploitation%20of%20Cisco%20ASA%20Zero%20Days "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F&text=Threat%20Insights:%20Active%20Exploitation%20of%20Cisco%20ASA%20Zero%20Days "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Threat%20Insights:%20Active%20Exploitation%20of%20Cisco%20ASA%20Zero%20Days%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fzero-day-vulnerabilities-affect-cisco-software%2F "Share in Mastodon") ## September 2025 Zero-Day Vulnerabilities Affecting Cisco Software Unit 42 stopped monitoring this threat and updating the brief on Dec. 2, 2025. Please refer to the Cisco website for the latest information. [Cisco has reported](https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks) that a sophisticated state-sponsored threat actor is actively exploiting multiple zero-day vulnerabilities in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Cisco identifies this as the same threat actor from a previous campaign they named ArcaneDoor. This threat actor primarily targets government networks worldwide for data exfiltration. Cisco observed attackers exploiting these newly identified zero-day vulnerabilities while employing advanced evasion techniques to prevent logging and identification of this activity. The trend of suspected nation-state adversaries exploiting zero-day vulnerabilities in internet-facing devices continues. Also known as edge devices, these internet-facing appliances act as the security perimeter between an organization's internal network and the public internet. This includes firewalls, VPN gateways, routers and load balancers. Compromising these devices provides a direct and often stealthy entry point into a network. ## Details of the Vulnerabilities Cisco published advisories for three critical vulnerabilities in ASA and FTD. Two of these, [CVE-2025-20333](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) and [CVE-2025-20362](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW), are currently under active exploitation by adversaries in the wild. Cisco identified a third vulnerability, [CVE-2025-20363](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O), as being at high risk for imminent exploitation. These vulnerabilities allow attackers to execute arbitrary code, exfiltrate data and implant persistent malware to maintain access even after a device is rebooted. |----------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------| | **CVE Number** | **Description** | **CVSS Severity** | | [CVE-2025-20333](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. | **9.9 Critical** | | [CVE-2025-20362](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW) | A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. | **6.7 Medium** | | [CVE-2025-20363](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O) | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. | **9.0 Critical** | As of Sep. 25, 2025, Cisco has released software updates to address all three vulnerabilities. It urges organizations to prioritize the immediate upgrade of all affected systems to the latest available software versions to mitigate the threat and prevent compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued [Emergency Directive (ED) 25-03](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices), mandating immediate mitigation for federal agencies due to the significant risk posed by this campaign. The vulnerabilities affect critical perimeter network devices, posing a substantial risk to both public and private sector organizations. The U.K.'s National Cyber Security Center (NCSC) published a [malware analysis report \[PDF\]](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf) on the RayInitiator and LINE VIPER malware families used in attacks to exploit these zero-day vulnerabilities. According to their analysis, RayInitiator is a multi-stage Grand Unified Bootloader (GRUB) bootkit that services reboots and firmware upgrades. It also deploys the LINE VIPER shellcode loader to Cisco ASA 5500-X series devices that do not have secure boot. LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS or via ICMP with responses over raw TCP. ## Lifecycle of Zero-Day Vulnerabilities Adversaries, particularly nation-state actors, are dedicating significant resources to discovering and exploiting zero-day vulnerabilities in edge devices. Since these flaws are previously unknown, they provide attackers a critical window of opportunity before a vendor can release a patch. Once a zero-day is weaponized, attackers can use the exploit against a wide range of organizations using the same vulnerable product. Additionally, after a nation-state actor successfully uses a zero-day exploit, the knowledge of that vulnerability and the methods for exploitation inevitably become less exclusive over time. This leads to a secondary, and often more widespread, phase of exploitation. Other threat actors may reverse-engineer the original sophisticated exploit, or a public advisory and patch release from a vendor might reveal the underlying vulnerability. This disclosure acts as a blueprint for cybercriminal groups and opportunistic hackers. These adversaries then develop their own proof-of-concept (PoC) code, which is often simpler and less stealthy than the nation-state's original exploit, but still highly effective against unpatched systems. This PoC code is rapidly weaponized and sold on dark web forums or integrated into exploit kits, making the once-exclusive capability of a nation-state accessible to a much broader range of financially motivated attackers. This phenomenon creates a "patch-or-perish" scenario, where organizations that fail to apply vendor patches promptly are left highly vulnerable to a new wave of mass-scale, opportunistic attacks. ## Conclusion Palo Alto Networks recommends patching immediately. Cisco also provides [temporary mitigation guidance]() for devices that are vulnerable but unable to be updated. Those temporary mitigations include their own risks, such as disabling SSL/TLS-based VPN web services. Palo Alto Networks recommends reviewing the following advisories for further information about the campaign and detecting this activity. * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW) * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O) The [Appendix](#post-159141-_82r956t6ygn5) to this article provides two hunting queries for our Cortex XDR and XSIAM customers to identify when logging is disabled or disrupted from Cisco ASA devices. If you think you might have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) * UK: +44.20.3743.3660 * Europe and Middle East: +31.20.299.3130 * Asia: +65.6983.8730 * Japan: +81.50.1790.0200 * Australia: +61.2.4062.7950 * India: 000 800 050 45107 ## Additional Resources * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB) - Cisco * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Unauthorized Access Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW) - Cisco * [Security Advisory: Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, IOS Software, IOS XE Software, and IOS XR Software Web Services Remote Code Execution Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O) - Cisco * [Cisco Event Response: Continued Attacks Against Cisco Firewalls](https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks) - Cisco * [Detection Guide for Continued Attacks against Cisco Firewalls by the Threat Actor behind ArcaneDoor](https://sec.cloudapps.cisco.com/security/center/resources/detection_guide_for_continued_attacks) - Cisco * [Malware Analysis Report: RayInitiator \& LINE VIPER \[PDF\]](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf) - National Cyber Security Center, UK ## Appendix Unit 42 developed the following two hunting queries for our Cortex XDR customers to identify when logging is disabled or disrupted from Cisco ASA devices. This query graphs all log types from Cisco ASA devices: dataset = cisco\_asa\_raw | alter alert\_level = arrayindex(regextract(\_raw\_log, "\\s%.\*?(ASA\\-\[\\d\])\\-\[\\d\]{1,}\\:"), 0) | alter alert\_level\_friendly = "" | alter alert\_level\_friendly = if((alert\_level contains "ASA-1"), "Alert Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-2"), "Critical Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-3"), "Error Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-4"), "Warning Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-5"), "Notification Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-6"), "Informational Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-7"), "Debug Message", alert\_level\_friendly) | alter debug\_count = if(alert\_level = "ASA-7", 1, 0) | alter info\_count = if(alert\_level = "ASA-6", 1, 0) | alter notification\_count = if(alert\_level = "ASA-5", 1, 0) | alter warning\_count = if(alert\_level = "ASA-4", 1, 0) | alter error\_count = if(alert\_level = "ASA-3", 1, 0) | alter critical\_count = if(alert\_level = "ASA-2", 1, 0) | alter alert\_count = if(alert\_level = "ASA-1", 1, 0) | alter Date = format\_timestamp("%Y/%m/%d", \_time) // Check for all messages | comp sum(info\_count) as info\_log\_count, sum(debug\_count) as debug\_log\_count, sum(notification\_count) as notification\_log\_count, sum(warning\_count) as warning\_log\_count, sum(error\_count) as error\_log\_count, sum(critical\_count) as critical\_log\_count, sum(alert\_count) as alert\_log\_count by Date | sort asc Date | view graph type = line xaxis = Date yaxis = info\_log\_count, debug\_log\_count, notification\_log\_count, warning\_count, error\_log\_count,critical\_log\_count,alert\_log\_count header = "All Logs" |-------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | dataset = cisco\_asa\_raw | alter alert\_level = arrayindex(regextract(\_raw\_log, "\\s%.\*?(ASA\\-\[\\d\])\\-\[\\d\]{1,}\\:"), 0) | alter alert\_level\_friendly = "" | alter alert\_level\_friendly = if((alert\_level contains "ASA-1"), "Alert Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-2"), "Critical Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-3"), "Error Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-4"), "Warning Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-5"), "Notification Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-6"), "Informational Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-7"), "Debug Message", alert\_level\_friendly) | alter debug\_count = if(alert\_level = "ASA-7", 1, 0) | alter info\_count = if(alert\_level = "ASA-6", 1, 0) | alter notification\_count = if(alert\_level = "ASA-5", 1, 0) | alter warning\_count = if(alert\_level = "ASA-4", 1, 0) | alter error\_count = if(alert\_level = "ASA-3", 1, 0) | alter critical\_count = if(alert\_level = "ASA-2", 1, 0) | alter alert\_count = if(alert\_level = "ASA-1", 1, 0) | alter Date = format\_timestamp("%Y/%m/%d", \_time) // Check for all messages | comp sum(info\_count) as info\_log\_count, sum(debug\_count) as debug\_log\_count, sum(notification\_count) as notification\_log\_count, sum(warning\_count) as warning\_log\_count, sum(error\_count) as error\_log\_count, sum(critical\_count) as critical\_log\_count, sum(alert\_count) as alert\_log\_count by Date | sort asc Date | view graph type = line xaxis = Date yaxis = info\_log\_count, debug\_log\_count, notification\_log\_count, warning\_count, error\_log\_count,critical\_log\_count,alert\_log\_count header = "All Logs" | This query graphs debug and info logging from Cisco ASA devices (Note: debug and info logs require manual configuration): dataset = cisco\_asa\_raw | alter alert\_level = arrayindex(regextract(\_raw\_log, "\\s%.\*?(ASA\\-\[\\d\])\\-\[\\d\]{1,}\\:"), 0) | alter alert\_level\_friendly = "" | alter alert\_level\_friendly = if((alert\_level contains "ASA-1"), "Alert Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-2"), "Critical Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-3"), "Error Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-4"), "Warning Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-5"), "Notification Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-6"), "Informational Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-7"), "Debug Message", alert\_level\_friendly) | alter debug\_count = if(alert\_level = "ASA-7", 1, 0) | alter info\_count = if(alert\_level = "ASA-6", 1, 0) | alter notification\_count = if(alert\_level = "ASA-5", 1, 0) | alter warning\_count = if(alert\_level = "ASA-4", 1, 0) | alter error\_count = if(alert\_level = "ASA-3", 1, 0) | alter critical\_count = if(alert\_level = "ASA-2", 1, 0) | alter alert\_count = if(alert\_level = "ASA-1", 1, 0) | alter Date = format\_timestamp("%Y/%m/%d", \_time) // Focus only on the Informational and Debug messages | filter alert\_level\_friendly in ("Informational Message", "Debug Message") | comp sum(info\_count) as info\_log\_count, sum(debug\_count) as debug\_log\_count by Date | sort asc Date | view graph type = line xaxis = Date yaxis = info\_log\_count, debug\_log\_count header = "Info + Debug Logs" |-------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | dataset = cisco\_asa\_raw | alter alert\_level = arrayindex(regextract(\_raw\_log, "\\s%.\*?(ASA\\-\[\\d\])\\-\[\\d\]{1,}\\:"), 0) | alter alert\_level\_friendly = "" | alter alert\_level\_friendly = if((alert\_level contains "ASA-1"), "Alert Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-2"), "Critical Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-3"), "Error Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-4"), "Warning Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-5"), "Notification Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-6"), "Informational Message", alert\_level\_friendly) | alter alert\_level\_friendly = if((alert\_level contains "ASA-7"), "Debug Message", alert\_level\_friendly) | alter debug\_count = if(alert\_level = "ASA-7", 1, 0) | alter info\_count = if(alert\_level = "ASA-6", 1, 0) | alter notification\_count = if(alert\_level = "ASA-5", 1, 0) | alter warning\_count = if(alert\_level = "ASA-4", 1, 0) | alter error\_count = if(alert\_level = "ASA-3", 1, 0) | alter critical\_count = if(alert\_level = "ASA-2", 1, 0) | alter alert\_count = if(alert\_level = "ASA-1", 1, 0) | alter Date = format\_timestamp("%Y/%m/%d", \_time) // Focus only on the Informational and Debug messages | filter alert\_level\_friendly in ("Informational Message", "Debug Message") | comp sum(info\_count) as info\_log\_count, sum(debug\_count) as debug\_log\_count by Date | sort asc Date | view graph type = line xaxis = Date yaxis = info\_log\_count, debug\_log\_count header = "Info + Debug Logs" | Back to top ### Tags * [Cisco](https://unit42.paloaltonetworks.com/tag/cisco/ "Cisco") * [CVE-2025-20333](https://unit42.paloaltonetworks.com/tag/cve-2025-20333/ "CVE-2025-20333") * [CVE-2025-20362](https://unit42.paloaltonetworks.com/tag/cve-2025-20362/ "CVE-2025-20362") * [CVE-2025-20363](https://unit42.paloaltonetworks.com/tag/cve-2025-20363/ "CVE-2025-20363") * [Zero-day](https://unit42.paloaltonetworks.com/tag/zero-day/ "zero-day") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Bookworm to Stately Taurus Using the Unit 42 Attribution Framework](https://unit42.paloaltonetworks.com/bookworm-to-stately-taurus/ "Bookworm to Stately Taurus Using the Unit 42 Attribution Framework") ### Table of Contents * ### Related Articles * [The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "article - table of contents") * [Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "article - table of contents") * [Fracturing Software Security With Frontier AI Models](https://unit42.paloaltonetworks.com/ai-software-security-risks/ "article - table of contents") ## Related General Resources ![Pictorial representation of a woman in glasses viewing a reflection of a monitor screen. The reflection features multicolored numbers, arrows, and graphs.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/07_Opinion_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 2, 2026 [#### An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation") ![New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_General_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 28, 2026 [#### Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety](https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Jailbreak](https://unit42.paloaltonetworks.com/tag/jailbreak/ "Jailbreak") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/perturbation-probing-llm-safety/ "Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety") ![Pictorial representation of a male individual viewing multiple monitor screens. The blurred background indicates a female indiviual in the back, also viewing multiple monitor screens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/09_Myth-Busting_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 21, 2026 [#### Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/) * [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop") * [Npm packages](https://unit42.paloaltonetworks.com/tag/npm-packages/ "npm packages") * [Software supply-chain attack](https://unit42.paloaltonetworks.com/tag/software-supply-chain-attack/ "software supply-chain attack") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain") ![Pictorial representation of large-scale credential attacks. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 18, 2026 [#### Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)](https://unit42.paloaltonetworks.com/large-scale-credential-attacks/) * [Credential theft](https://unit42.paloaltonetworks.com/tag/credential-theft/ "credential theft") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/large-scale-credential-attacks/ "Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)") ![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") * [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software") ![Pictorial representation of WebAuthn. A person wearing glasses with computer code reflected in the lenses. The focus is on the eye, and the code is clear and detailed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Myth-Busting_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) July 2, 2026 [#### How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/) * [IDA Pro](https://unit42.paloaltonetworks.com/tag/ida-pro/ "IDA Pro") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [RDP](https://unit42.paloaltonetworks.com/tag/rdp/ "RDP") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "How We Added WebAuthn to a Browser-Based RDP Client") ![Pictorial representation of an individual typing on a laptop featuring pop-up screens of lists and tasks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) June 12, 2026 [#### Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/) * [Digital forensics](https://unit42.paloaltonetworks.com/tag/digital-forensics/ "digital forensics") * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/ "Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered") ![Pictorial representation of an aerial view of an individual working on a cumputer in an office setting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/02_Opinion_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) June 8, 2026 [#### When "Hi, This Is IT" Comes Through Microsoft Teams](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/) * [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa") * [Identity](https://unit42.paloaltonetworks.com/tag/identity/ "identity") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/microsoft-teams-phishing/ "When “Hi, This Is IT” Comes Through Microsoft Teams") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)