CVE-2021-3063— PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
Quick assessment
Affected
Palo Alto Networks PAN-OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Palo Alto Networks GlobalProtect是美国Palo Alto Networks公司的一套网络防护软件。该软件可提供防火墙监控及威胁预防等功能。 Palo Alto Networks GlobalProtect portal and gateway存在安全漏洞，攻击者可利用该漏洞向GlobalProtect接口发送特制的流量，从而导致服务停止响应。受影响的系统包括：PAN-OS 8.1.21之前的PAN-OS 8.1版本；PAN-OS 9.0.14-h4之前的PAN-OS 9.0
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-3063
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
Source: CVE Program / CVE List V5
Vulnerability Description
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件的处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
GlobalProtect 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Palo Alto Networks GlobalProtect是美国Palo Alto Networks公司的一套网络防护软件。该软件可提供防火墙监控及威胁预防等功能。 Palo Alto Networks GlobalProtect portal and gateway存在安全漏洞，攻击者可利用该漏洞向GlobalProtect接口发送特制的流量，从而导致服务停止响应。受影响的系统包括：PAN-OS 8.1.21之前的PAN-OS 8.1版本；PAN-OS 9.0.14-h4之前的PAN-OS 9.0
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Palo Alto Networks | PAN-OS | 8.1 ~ 8.1.21 | - |
|
| Palo Alto Networks | Prisma Access | 2.2 all | - |
|
II. Public POCs for CVE-2021-3063
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-3063
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-3063 (1)
-
https://security.paloaltonetworks.com/CVE-2021-3063 x_refsource_MISC
Same Patch Batch · Palo Alto Networks · 2021-11-10 · 8 CVEs total
| CVE-2021-3064 | 9.8 CRITICAL | PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces |
| CVE-2021-3058 | 8.8 HIGH | PAN-OS: OS Command Injection Vulnerability in Web Interface XML API |
| CVE-2021-3056 | 8.8 HIGH | PAN-OS: Memory Corruption Vulnerability in GlobalProtect Clientless VPN During SAML Authen |
| CVE-2021-3062 | 8.1 HIGH | PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to G |
| CVE-2021-3060 | 8.1 HIGH | PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP) |
| CVE-2021-3059 | 8.1 HIGH | PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates |
| CVE-2021-3061 | 6.4 MEDIUM | PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI) |
IV. Related Vulnerabilities
Same product: PAN-OS
-
CVE-2025-0116
PAN-OS: Firewall Denial of Service (DoS) Using a Specially C -
CVE-2025-0115
PAN-OS: Authenticated Admin File Read Vulnerability in PAN-O -
CVE-2025-0114
PAN-OS: Denial of Service (DoS) in GlobalProtect -
CVE-2024-9471
PAN-OS: Privilege Escalation (PE) Vulnerability in XML API -
CVE-2024-8691
PAN-OS: User Impersonation in GlobalProtect Portal
Same vendor: Palo Alto Networks
-
CVE-2026-0301
PAN-OS: Information Disclosure Vulnerability in URL Filterin -
CVE-2026-0299
GlobalProtect App: Local Privilege Escalation Vulnerabilitie -
CVE-2026-0298
GlobalProtect App: Code Execution Vulnerability in Windows P -
CVE-2026-0297
GlobalProtect App: Buffer Overflow Vulnerability during UDP -
CVE-2026-0296
GlobalProtect App: Improper Certificate Validation Bypass Vu
Same weakness: CWE-755
-
CVE-2026-49305
Huawei HarmonyOS 异常处理不当漏洞 -
CVE-2026-59952
Valibot: record() issue paths can make flatten() throw for i -
CVE-2026-42792
epmd permanent DoS via EMFILE on accept(2) in erts -
CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and ov -
CVE-2026-16730
Dbus-broker: dbus-broker: session bus denial of service via
V. Comments for CVE-2021-3063
No comments yet