Loading story…
Palo Alto Networks released fixes for CVE-2026-0227, a high-severity denial-of-service vulnerability in PAN-OS that can be triggered by an unauthenticated attacker when the GlobalProtect gateway or portal is enabled on affected next-generation firewall and Prisma Access configurations. Repeated exploitation attempts can force impacted firewalls into maintenance mode, effectively disabling protections and causing service disruption; Palo Alto Networks stated there are no workarounds and advised upgrading to patched releases.
Reporting indicates a proof-of-concept (PoC) exploit exists, although Palo Alto Networks said it had no evidence of in-the-wild exploitation at the time of advisory publication. Exposure risk remains material given the large number of internet-facing Palo Alto Networks firewalls observed online (with Shadowserver tracking roughly 6,000 exposed devices) and ongoing scanning activity historically targeting exposed GlobalProtect endpoints; administrators should prioritize patching across affected PAN-OS and Prisma Access versions and validate whether GlobalProtect is enabled on externally reachable interfaces.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Coverage of the disclosure noted Shadowserver reporting nearly 6,000 Palo Alto Networks firewalls exposed online, though it was unclear how many were vulnerable or already patched. The reporting emphasized the risk to organizations with internet-accessible GlobalProtect services.
In its advisory, Palo Alto Networks stated that a proof-of-concept exploit for CVE-2026-0227 exists, but it had not observed exploitation in the wild at the time of disclosure. The company also noted there are no workarounds, making patching the primary mitigation.
Palo Alto Networks disclosed and released fixes for CVE-2026-0227, a high-severity denial-of-service flaw in PAN-OS GlobalProtect Gateway and Portal that can be triggered by an unauthenticated attacker. The bug affects supported PAN-OS and certain Prisma Access versions when GlobalProtect is enabled, and fixed releases were provided across multiple branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2026-0257**, an authentication bypass flaw in **PAN-OS GlobalProtect portal and gateway** that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while **Cloud NGFW** and **Panorama** were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override. Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to **Vultr** and **Dromatics Systems**. **CISA** added `CVE-2026-0257` to its **Known Exploited Vulnerabilities** catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including **OT/SCADA** networks. A separate Palo Alto advisory released alongside it also addressed **CVE-2026-0262**, a PAN-OS network traffic parsing denial-of-service issue.
Aug 31, 2026
Palo Alto Networks disclosed and patched **`CVE-2024-3400`**, a critical **CVSS 10.0** flaw in **PAN-OS** that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects **PAN-OS 10.2, 11.0, and 11.1** when **GlobalProtect Gateway or Portal** is enabled, while **Cloud NGFW, Panorama appliances, and Prisma Access** are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures **`95187`**, **`95189`**, and **`95191`** and to urge immediate upgrades. Post-compromise activity tracked by Unit 42 as **Operation MidnightEclipse** showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called **UPSTYLE** and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is **not** an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
Aug 15, 2026
Palo Alto Networks published fixes for multiple **PAN-OS** vulnerabilities affecting supported releases (including PAN-OS 12.1, 11.2, 11.1, and 10.2) and related services such as *Prisma Access* and *Prisma Browser*. The Canadian Centre for Cyber Security amplified the vendor guidance, pointing organizations to apply updates and mitigations for PAN-OS and Prisma products, including **CVE-2026-0228** and **CVE-2026-0229**, and a separate Chromium monthly update advisory referenced by Palo Alto. **CVE-2026-0229** is a network-reachable denial-of-service condition in PAN-OS’s **Advanced DNS Security (ADNS)** feature that can allow an unauthenticated attacker to trigger system reboots with a maliciously crafted packet; repeated triggering can push a firewall into maintenance mode, creating a high availability impact. Exposure requires ADNS to be enabled and a spyware profile action set to `block`, `sinkhole`, or `alert` (i.e., not `allow`); Palo Alto stated *Cloud NGFW* and *Prisma Access* are not impacted by this specific issue and reported no known exploitation. **CVE-2026-0228** involves improper certificate validation that can allow Windows Terminal Server Agents to connect using expired certificates under certain configurations, with no workaround noted by the vendor; affected organizations are advised to upgrade to fixed PAN-OS versions per Palo Alto’s guidance.
Jun 29, 2026