In a recent security breach dubbed “Operation Lunar Peek,” attackers exploited two Palo Alto Networks vulnerabilities, CVE-2024-0012 and CVE-2024-9474, affecting over 13,000 devices by chaining a seemingly manageable authentication bypass with a privilege escalation flaw. Despite individual CVSS scores that suggested remediation challenges—one vulnerability scored below common patching thresholds—combined they granted root access to numerous systems. Experts emphasize the failure of scoring systems to account for compound risks and real-world attack strategies, urging a shift beyond traditional CVSS-based prioritization to encompass chained vulnerabilities, rapid exploitation timelines, identity verification gaps, and the growing volume of discovered vulnerabilities due to AI technologies. Key measures include tightening patch deadlines, auditing chains of vulnerabilities, integrating identity-focused controls, and preparing for increased vulnerability discovery rates to prevent overwhelming existing security pipelines.
Back
