PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

published 2021-11-10 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26416

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 20.1%; EPSS 20.1% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.

Patch / fix

fixed in 1

Palo Alto Networks PAN-OS 8.1.17

Exploit prediction

20.11% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Palo Alto Networks PAN-OS
Palo Alto Networks Prisma Access

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write

Technology feeds

Palo Alto PAN-OS rss critical rss

References

security.paloaltonetworks.com /CVE-2021-3064
vendor-advisory

Sources

CVE List CVE-2021-3064
NVD CVE-2021-3064

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary