What’s Vulnerable › Vulnerabilities

CVE-2026-0227: PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-754

Description

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.

Affected products

• Palo Alto Networks PAN-OS: from 10.1.0 before 10.1.14; from 10.2.0 before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4 — fixed in 10.1.14, 10.2.7, 10.2.10, 10.2.13, 10.2.16, 11.1.4
• Palo Alto Networks Prisma Access: all versions
• Palo Alto Networks PAN-OS: from 12.1.2 before 12.1.4, 12.1.3-h3; from 11.2.0 before 11.2.10-h2, 11.2.7-h8, 11.2.4-h15; from 11.1.0 before 11.1.13, 11.1.10-h9, 11.1.6-h23, 11.1.4-h27; from 10.2.0 before 10.2.18-h1, 10.2.16-h6, 10.2.13-h18, 10.2.10-h30, 10.2.7-h32; from 10.1.0 before 10.1.14-h20 — fixed in 12.1.4, 12.1.3-h3, 12.1.3-h3, 12.1.4, 11.2.10-h2, 11.2.7-h8
• Palo Alto Networks Prisma Access: from 11.2 before 11.2.7-h8; from 10.2 before 10.2.10-h29, 10.2.4-h43 — fixed in 11.2.7-h8, 10.2.10-h29, 10.2.4-h43, 10.2.4-h43, 10.2.10-h29

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.1.14, 10.2.7, 10.2.10, 10.2.13; Palo Alto Networks PAN-OS 12.1.4, 12.1.3-h3, 12.1.3-h3, 12.1.4; Palo Alto Networks Prisma Access 11.2.7-h8, 10.2.10-h29, 10.2.4-h43, 10.2.4-h43. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2026-0227

Get alerted when CVE-2026-0227 or the next vulnerability affects your stack