Article Details
Scrape Timestamp (UTC): 2026-01-15 08:22:25.354
Source: https://thehackernews.com/2026/01/palo-alto-fixes-globalprotect-dos-flaw.html
Original Article Text
Click to Toggle View
Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login. Palo Alto Networks has released security updates for a high-severity security flaw impacting GlobalProtect Gateway and Portal, for which it said there exists a proof-of-concept (PoC) exploit. The vulnerability, tracked as CVE-2026-0227 (CVSS score: 7.7), has been described as a denial-of-service (DoS) condition impacting GlobalProtect PAN-OS software arising as a result of an improper check for exceptional conditions (CWE-754) "A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial-of-service (DoS) to the firewall," the company said in an advisory released Wednesday. "Repeated attempts to trigger this issue result in the firewall entering into maintenance mode." The issue, discovered and reported by an unnamed external researcher, affects the following versions - Palo Alto Networks also clarified that the vulnerability is applicable only to PAN-OS NGFW or Prisma Access configurations with an enabled GlobalProtect gateway or portal. The company's Cloud Next-Generation Firewall (NGFW) is not impacted. There are no workarounds to mitigate the flaw. While there is no evidence that the vulnerability has been exploited in the wild, it's essential to keep the devices up-to-date, especially given that exposed GlobalProtect gateways have witnessed repeated scanning activity over the past year.
Daily Brief Summary
Palo Alto Networks has addressed a high-severity denial-of-service vulnerability in its GlobalProtect Gateway and Portal, tracked as CVE-2026-0227, with a CVSS score of 7.7.
The flaw allows unauthenticated attackers to crash firewalls by exploiting improper checks for exceptional conditions, causing the system to enter maintenance mode.
Impacted systems include specific configurations of PAN-OS NGFW or Prisma Access with GlobalProtect enabled, while Cloud Next-Generation Firewall remains unaffected.
Discovered by an external researcher, this vulnerability currently has no known workarounds, prompting immediate software updates to mitigate potential risks.
Although there is no evidence of active exploitation, repeated scanning of GlobalProtect gateways over the past year indicates potential interest from threat actors.
Organizations are urged to prioritize updating affected systems to prevent potential service disruptions and maintain robust network security.