Image Main

Palo Alto Networks has released a major security update to address a high severity vulnerability affecting its GlobalProtect Gateway and Portal software. The company has confirmed the existence of a proof-of-concept (PoC) exploit for this flaw, underscoring the urgency of patching.

Vulnerability Description (CVE-2026-0227)

The vulnerability, identified as CVE-2026-0227, has a CVSS score of 7.7 and has been classified as a denial of service (DoS) condition. The issue resides in GlobalProtect’s PAN-OS software and arises from inadequate checking for exceptional conditions (CWE-754).

According to the Palo Alto Networks security advisory:

  • An unauthenticated attacker can cause a denial of service in the firewall.
  • Repeated attempts to exploit this flaw can cause the firewall to go into maintenance mode.

The vulnerability was discovered and reported by an anonymous third-party researcher.

Affected Versions

The security flaw impacts the following versions of PAN-OS and Prisma Access software:

  • PAN-OS 12.1: Versions prior to 12.1.3-h3 and 12.1.4
  • PAN-OS 11.2: Versions prior to 11.2.4-h15, 11.2.7-h8 and 11.2.10-h2
  • PAN-OS 11.1: Versions prior to 11.1.4-h27, 11.1.6-h23, 11.1.10-h9 and 11.1.13
  • PAN-OS 10.2: Versions earlier than 10.2.7-h32, 10.2.10-h30, 10.2.13-h18, 10.2.16-h6 and 10.2.18-h1
  • PAN-OS 10.1: Versions prior to 10.1.14-h20
  • Prisma Access 11.2: Versions prior to 11.2.7-h8
  • Prisma Access 10.2: Versions prior to 10.2.10-h29

Conditions of Applicability and Mitigation

It is crucial to note that this vulnerability is only applicable to PAN-OS NGFW or Prisma Access configurations that have a GlobalProtect gateway or portal enabled. The company’s Cloud Next-Generation Firewall (NGFW) is not affected.

Currently, there are no workarounds to mitigate this failure, which makes patching the only way to protect systems.

Although there is no evidence that this vulnerability has been actively exploited in the wild, the importance of keeping devices up to date is critical. Over the past year, repeated scanning activity has been observed on exposed GlobalProtect gateways, highlighting the attraction of these systems to potential attackers.

Conclusion

The disclosure of CVE-2026-0227 by Palo Alto Networks underscores the need for proactive patch management. Given the nature of denial of service and the existence of a PoC exploit, system administrators are strongly recommended to update their GlobalProtect and PAN-OS devices to the patched versions as soon as possible to avoid potential service interruptions and ensure continuity of operations.

References

  • CVE-2026-0227: Denial of service vulnerability in GlobalProtect Gateway and Palo Alto Networks Portal.
  • CWE-754: Improper Check for Exceptional Conditions.