CVSS 10.0. Threat actor UTA0218 exploited zero-day in PAN-OS GlobalProtect feature allowing unauthenticated OS command execution as root. Affected PAN-OS 10.2, 11.0, 11.1 with GlobalProtect enabled. Exploitation observed from at least March 26 2024. Volexity discovered via anomalous exfiltration at customer site and alerted Palo Alto April 10. Attacker deployed UPSTYLE Python backdoor. Patches released April 14. CISA KEV added same day. Thousands of devices exposed.