Loading vulnerability…
DoS in Palo Alto Networks PAN-OS GlobalProtect Gateway and Portal
CVE-2026-0227 is a high-severity denial-of-service vulnerability in Palo Alto Networks PAN-OS affecting the GlobalProtect Gateway and GlobalProtect Portal components. The flaw allows an unauthenticated remote attacker to trigger a denial-of-service condition on affected firewalls, and repeated triggering can force the device into maintenance mode. The issue is associated with improper handling of unusual or exceptional conditions and affects PAN-OS and Prisma Access deployments where GlobalProtect gateway or portal functionality is enabled. Cloud NGFW deployments are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes loss of availability on the affected firewall. An attacker can disrupt GlobalProtect services and firewall traffic processing, and repeated exploitation attempts can push the firewall into maintenance mode, effectively interrupting remote access and broader network connectivity until administrative recovery actions are taken.
If you can’t patch tonight, do this now.
No workaround is currently available. The only effective mitigation identified is prompt installation of the vendor-provided fixes. Organizations should prioritize externally exposed GlobalProtect-enabled deployments and reduce exposure of vulnerable services until patching is completed.
Patch, then assume compromise.
Apply Palo Alto Networks security updates to a fixed PAN-OS or Prisma Access release. Fixed versions identified include PAN-OS 12.1.3-h3 and later or 12.1.4 and later, 11.2.4-h15 and later, 11.2.7-h8 and later, 11.2.10-h2 and later, 11.1.4-h27 and later, 11.1.6-h23 and later, 11.1.10-h9 and later, 11.1.13 and later, 10.2.7-h32 and later, 10.2.10-h30 and later, 10.2.13-h18 and later, 10.2.16-h6 and later, 10.2.18-h1 and later, 10.1.14-h20 and later, Prisma Access 11.2.7-h8 and later, and Prisma Access 10.2.10-h29 and later. Unsupported releases should be upgraded to a supported fixed version.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.