Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

Palo Alto Networks has released security updates for a high-severity security flaw impacting GlobalProtect Gateway and Portal, for which it said there exists a proof-of-concept (PoC) exploit.

The vulnerability, tracked as CVE-2026-0227 (CVSS score: 7.7), has been described as a denial-of-service (DoS) condition impacting GlobalProtect PAN-OS software arising as a result of an improper check for exceptional conditions (CWE-754)

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial-of-service (DoS) to the firewall,” the company said in an advisory released Wednesday. “Repeated attempts to trigger this issue result in the firewall entering into maintenance mode.”

The issue, discovered and reported by an unnamed external researcher, affects the following versions –

• PAN-OS 12.1 < 12.1.3-h3, < 12.1.4
• PAN-OS 11.2 < 11.2.4-h15, < 11.2.7-h8, < 11.2.10-h2
• PAN-OS 11.1 < 11.1.4-h27, < 11.1.6-h23, < 11.1.10-h9, < 11.1.13
• PAN-OS 10.2 < 10.2.7-h32, < 10.2.10-h30, < 10.2.13-h18, < 10.2.16-h6, < 10.2.18-h1
• PAN-OS 10.1 < 10.1.14-h20
• Prisma Access 11.2 < 11.2.7-h8
• Prisma Access 10.2 < 10.2.10-h29

Palo Alto Networks also clarified that the vulnerability is applicable only to PAN-OS NGFW or Prisma Access configurations with an enabled GlobalProtect gateway or portal. The company’s Cloud Next-Generation Firewall (NGFW) is not impacted. There are no workarounds to mitigate the flaw.

While there is no evidence that the vulnerability has been exploited in the wild, it’s essential to keep the devices up-to-date, especially given that exposed GlobalProtect gateways have witnessed repeated scanning activity over the past year.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.