Palo Alto Networks addressed a GlobalProtect flaw, PoC exists

Palo Alto Networks has addressed a high-severity vulnerability in GlobalProtect, tracked as CVE-2026-0227, with a proof-of-concept exploit existing. The flaw affects GlobalProtect Gateway and Portal and can cause a denial-of-service by an unauthenticated attacker, potentially forcing the device into maintenance mode after repeated attempts.

The advisory lists impacted and unaffected PAN-OS versions, and notes that the vulnerability affects PAN-OS or Prisma Access setups where the GlobalProtect gateway or portal is enabled, with Cloud NGFW remaining unaffected. At the time of writing, there are no reports of active exploitation in the wild against this vulnerability. In December 2025, a hacking campaign began targeting GlobalProtect logins and scanning SonicWall APIs from 2 December 2025.

The article carrying these details was published on 15 January 2026, and emphasises that the issue can be triggered by repeatedly exploiting the flaw, interrupting network traffic and firewall protection until remediation.