Palo Alto Networks has released security updates for a high-severity denial-of-service (DoS) vulnerability, CVE-2026-0227 (CVSS 7.7/10), affecting PAN-OS firewalls and Prisma Access deployments when a GlobalProtect gateway or portal is enabled, stemming from an improper check for exceptional conditions (CWE-754) that allows unauthenticated attackers to repeatedly trigger maintenance mode and disrupt firewall protections. The company confirmed a proof-of-concept exploit exists but reported no evidence of in-the-wild exploitation to date, noting that Cloud NGFW is not impacted and that there are no viable workarounds beyond patching. Most cloud-hosted Prisma Access instances have already been upgraded, with remaining customers scheduled through standard maintenance windows, while on-premises administrators are urged to update across affected PAN-OS branches. Risk remains elevated given sustained reconnaissance and attack interest in GlobalProtect infrastructure. Shadowserver tracks nearly 6,000 Palo Alto Networks firewalls exposed online, and GreyNoise has recently warned of large-scale automated activity targeting GlobalProtect portals. Set against a backdrop of multiple PAN-OS zero-day and DoS incidents in recent years, CTIX analysts emphasize immediate patching to mitigate disruption risks to widely deployed environments across government, service providers, and large enterprises.