An unauthenticated attacker can trigger a denial of service on a Palo Alto Networks firewall by repeatedly sending crafted packets to the GlobalProtect Gateway and Portal. The vulnerability causes the firewall to enter maintenance mode, effectively disabling packet forwarding and rendering the appliance unusable. This weakness is classified as CWE-754 (defect at maintain/repair).

The flaw affects Palo Alto Networks Cloud NGFW, PAN-OS, and Prisma Access products. Affected PAN‑OS releases include 12.1.2 through 12.1.3, 11.2.8 through 11.2.10, 11.1.0 through 11.1.12, and 10.2.10 along with multiple intermediate sub‑versions. The Cloud NGFW is considered unaffected. The precise version ranges are listed in the vendor’s advisory and should be compared against the current deployment.

The CVSS score is 6.6, indicating medium severity, while the EPSS score is less than 1%, reflecting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Knowledge Exploited Vulnerabilities catalog. The likely attack vector is remote network traffic; the attacker does not need authentication and simply must send the malformed packets to the firewall from a network that can reach the GlobalProtect endpoints.