Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

Palo Alto Networks has released security updates for a high-severity DoS flaw in GlobalProtect Gateway and Portal, which is linked to a proof-of-concept exploit. The vulnerability, tracked as CVE-2026-0227 (CVSS 7.7), arises from an improper check for exceptional conditions and can allow an unauthenticated attacker to crash the firewall, with repeated attempts potentially forcing maintenance mode, according to Palo Alto Networks.

The issue affects multiple PAN-OS versions, including 12.1, 11.2, 11.1, 10.2, and 10.1, as well as Prisma Access 11.2 and 10.2, and applies only to configurations with an enabled GlobalProtect gateway or portal; the Cloud Next-Generation Firewall is not impacted. The vulnerability was discovered by an unnamed external researcher, and Palo Alto Networks notes there are no workarounds to mitigate it.

While there is no evidence of exploitation in the wild, the firm stresses keeping affected devices up to date due to exposed GlobalProtect gateways having seen scanning activity over the past year, according to Palo Alto Networks. Jan 15, 2026.