PAN-OS GlobalProtect portal and gateway
CVE-2026-0227: Unauthenticated requests can knock PAN-OS firewalls into maintenance mode
A flaw in GlobalProtect lets an unauthenticated attacker crash the firewall; repeated attempts push it into maintenance mode (CVSS 7.7). Palo Alto rates exploit maturity as proof of concept; no attacks are reported.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PAN-OS 12.1 | 12.1.3-h3, 12.1.4 or later |
| PAN-OS 11.2 | 11.2.4-h15, 11.2.7-h8, 11.2.10-h2 or later |
| PAN-OS 11.1 | 11.1.4-h27, 11.1.6-h23, 11.1.10-h9, 11.1.13 or later |
| PAN-OS 10.2 | 10.2.7-h32, 10.2.10-h31, 10.2.13-h18, 10.2.16-h6, 10.2.18-h1 or later |
| PAN-OS 10.1 | 10.1.14-h20 or later |
| Older PAN-OS (end of life) | No fix. Upgrade to a supported fixed version |
| Prisma Access 11.2 / 10.2 | Upgraded by Palo Alto Networks (11.2.7-h8; 10.2.4-h43 or 10.2.10-h29) |
| Cloud NGFW | Not affected |
What it is
On PAN-OS firewalls with a GlobalProtect portal or gateway enabled, an unauthenticated attacker can make the firewall fail. Palo Alto Networks classifies it as an improper check for unusual or exceptional conditions. One attempt causes a denial of service. Repeated attempts push the firewall into maintenance mode, where it stops passing traffic until an administrator recovers it.
This is availability only: no data access and no code execution. But for a firewall that is the VPN entry point and the internet edge, an outage is the impact. No login is needed, and the GlobalProtect portal is internet-facing by design.
Palo Alto Networks rates the exploit maturity as proof of concept, meaning working attack code exists, but says it is not aware of malicious exploitation. It is not in the CISA KEV catalog.
Am I affected?
You’re affected if both are true:
- Your PAN-OS version is in an affected range (see the table above). PAN-OS 10.1, 10.2, 11.1, 11.2 and 12.1 all have affected releases.
- A GlobalProtect portal or gateway is enabled on the firewall.
Check your version (CLI):
show system info | match sw-version
Check for GlobalProtect in the web interface under Network > GlobalProtect > Portals and Network > GlobalProtect > Gateways. If either list has an entry, the device is exposed.
Prisma Access tenants were upgraded by Palo Alto Networks. Cloud NGFW is not affected. End-of-life PAN-OS versions are affected and get no fix.
What to do
1. Upgrade to a fixed release on your branch. Pick the newest hotfix, not just the minimum listed here. Later Palo Alto advisories, such as CVE-2026-0257 in May, need newer builds than this fix.
2. There is no workaround. Palo Alto Networks lists none. If you don’t use GlobalProtect on a device, disabling the portal and gateway removes the exposure, but that also removes remote access.
3. Plan for recovery. A firewall in maintenance mode needs hands-on recovery. Make sure your team knows how to reach the console of each firewall that runs GlobalProtect, especially remote sites.
Detection
Palo Alto Networks hasn’t published indicators. Watch for the effects:
- Unexpected restarts or crashes of GlobalProtect-enabled firewalls, especially several in a short time.
- A firewall entering maintenance mode without an administrator action.
- GlobalProtect outages that line up with traffic to the portal or gateway from unfamiliar addresses.
If you see repeated crashes on an unpatched GlobalProtect firewall, treat it as a likely attack, patch first, and contact Palo Alto Networks support.
Indicators of compromise
No indicators of compromise have been published. Checked Palo Alto Networks and the CISA KEV catalog; the CVE is not in KEV.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.