CVE-2021-3038: GlobalProtect App: Windows VPN kernel driver denial of service (DoS)

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-20 · updated 2026-06-17
Weakness: CWE-20

Description

A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4.

Affected products

Palo Alto Networks GlobalProtect App: from 5.1.0 before 5.1.8; from 5.2.0 before 5.2.4 — fixed in 5.1.8, 5.2.4
Palo Alto Networks GlobalProtect App: from 5.1 before 5.1.8; from 5.2 before 5.2.4 — fixed in 5.1.8, 5.2.4

How to fix

Upgrade to a fixed version: Palo Alto Networks GlobalProtect App 5.1.8, 5.2.4; Palo Alto Networks GlobalProtect App 5.1.8, 5.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3038 or the next vulnerability affects your stack