VulnSocial

CVE-2026-0227Disclosure(paloaltonetworks / pan-os)

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for paloaltonetworks pan-os systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.

paloaltonetworks CVEsBack to dashboard
5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-754

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pan-os
  • prisma_access

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • 6 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 5d ago at 1 mentions (2026-01-28); latest day: 1
  • 6 total mentions across 6 days

Affected systems

Vendors
paloaltonetworks
Products
pan-osprisma_access

16 versions affected across 2 products

Deep dive

Activity timeline6 mentions / 6d
00111Mentions · 2026-01-28: 1Mentions · 2026-01-29: 1Mentions · 2026-01-31: 1Mentions · 2026-02-07: 1Mentions · 2026-02-09: 1Mentions · 2026-05-31: 1PoC Mentioned / Linked · 2026-01-28: 1Active Exploitation · 2026-05-31: 1Technical Details · 2026-01-28: 1Technical Details · 2026-01-31: 1Technical Details · 2026-02-07: 1Technical Details · 2026-02-09: 101-2801-2901-3102-0702-0905-31
Signal classification4 categories
Disclosure
350.0%
PoC
116.7%
General
116.7%
Active Exploitation
116.7%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-01-281
PoC1
2026-01-291
General1
2026-01-311
Disclosure1
2026-02-071
Disclosure1
2026-02-091
Disclosure1
2026-05-311
Active Exploitation1
Full discourse6 posts
  • まっちゃだいふく@ripjyr
    Disclosure

    Paloaltoの脆弱性情報 「CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (Severity: HIGH)」が公開されました。 → https://security.paloaltonetworks.com/CVE-2026-0227

    Post summary

    The post announces the publication of Palo Alto Networks' CVE-2026-0227, a high‑severity Denial of Service vulnerability in PAN‑OS GlobalProtect Gateway and Portal.

    01040605
    8.6K followersView on X
  • まっちゃだいふく@ripjyr
    Disclosure

    Paloaltoの脆弱性情報 「CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (Severity: HIGH)」が公開されました。 → https://security.paloaltonetworks.com/CVE-2026-0227

    Post summary

    The text announces the publication of a Palo Alto Networks vulnerability advisory for CVE-2026-0227, detailing a high‑severity DoS issue in GlobalProtect, without referencing PoCs, exploits, or patches.

    00030593
    8.6K followersView on X
  • חדשות סייבר@CyberIL
    Active Exploitation

    שימו לב לחולשה קריטית CVE-2026-0227, במערכת של פאלו אלטו PAN-OS GlobalProtect, המנוצלת בפועל ע"י תוקפים מסביב לעולם. https://t.me/CyberSecurityIL/9012

    Post summary

    The post indicates that CVE-2026-0227 concerning Palo Alto PAN-OS GlobalProtect is in active exploitation worldwide, but it lacks details about the vulnerability, patches, or PoC.

    00020279
    2.8K followersView on X
  • まっちゃだいふく@ripjyr
    Disclosure

    Paloaltoの脆弱性情報 「CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (Severity: HIGH)」が公開されました。 → https://security.paloaltonetworks.com/CVE-2026-0227

    Post summary

    An advisory has been released detailing a new high‑severity DoS vulnerability in Palo Alto Networks’ GlobalProtect gateway and portal; it provides basic technical details but no PoC, exploit, or mitigation information.

    00010556
    8.6K followersView on X
  • transilienceai@transilienceai
    PoC

    @RoryCrave Unauthenticated attackers can repeatedly trigger CVE-2026-0227 to force firewalls into maintenance mode, disrupting traffic. A proof-of-concept exploit exists, but no wild exploitation is known yet. #VulnManagement 🛠️

    Post summary

    Unauthenticated attackers can trigger CVE-2026-0227 to force firewalls into maintenance mode; a proof‑of‑concept exists but no active exploitation has been reported.

    1000057
    319 followersView on X
  • ꉓꍏꂵꍟꋪꂦꈤ@CameronMaerz
    General

    anyone have any info on CVE-2026-0227

    Post summary

    The user is asking for details about CVE-2026-0227, but no additional information is provided.

    0000048
    161 followersView on X
CPE platform detail108 entries

108 of 108 entries

PartVendorProductVersionTarget SWTarget HW
OSpaloaltonetworkspan-os---
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.16--
OSpaloaltonetworkspan-os10.2.16--
OSpaloaltonetworkspan-os10.2.16--
OSpaloaltonetworkspan-os10.2.17--
OSpaloaltonetworkspan-os10.2.18--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.10--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.10--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os11.2.7--
OSpaloaltonetworkspan-os12.1.2--
OSpaloaltonetworkspan-os12.1.3--
OSpaloaltonetworkspan-os12.1.3--
Apppaloaltonetworksprisma_access---

Explore more

Back to dashboardpaloaltonetworks CVEspan-os vulnerabilities