Palo Alto Networks PAN-OS GlobalProtect DoS Vulnerability (CVE-2026-0227)

Palo Alto Networks released fixes for CVE-2026-0227, a high-severity denial-of-service vulnerability in PAN-OS that can be triggered by an unauthenticated attacker when the GlobalProtect gateway or portal is enabled on affected next-generation firewall and Prisma Access configurations. Repeated exploitation attempts can force impacted firewalls into maintenance mode, effectively disabling protections and causing service disruption; Palo Alto Networks stated there are no workarounds and advised upgrading to patched releases.

Reporting indicates a proof-of-concept (PoC) exploit exists, although Palo Alto Networks said it had no evidence of in-the-wild exploitation at the time of advisory publication. Exposure risk remains material given the large number of internet-facing Palo Alto Networks firewalls observed online (with Shadowserver tracking roughly 6,000 exposed devices) and ongoing scanning activity historically targeting exposed GlobalProtect endpoints; administrators should prioritize patching across affected PAN-OS and Prisma Access versions and validate whether GlobalProtect is enabled on externally reachable interfaces.