CVE-2025-0114 Overview
A Denial of Service (DoS) vulnerability exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software that enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This vulnerability affects both the GlobalProtect portal and the GlobalProtect gateway, potentially disrupting remote access capabilities for organizations relying on this VPN solution.
This issue does not apply to Cloud NGFWs or Prisma Access software, limiting the scope to on-premises PAN-OS deployments utilizing the GlobalProtect feature.
Critical Impact
Unauthenticated attackers can disrupt GlobalProtect VPN services through sustained packet flooding, potentially severing remote workforce connectivity and impacting business continuity.
Affected Products
- Palo Alto Networks PAN-OS (multiple versions including 10.1.14 hotfix releases)
- GlobalProtect Portal component
- GlobalProtect Gateway component
Discovery Timeline
- March 12, 2025 - CVE-2025-0114 published to NVD
- October 22, 2025 - Last updated in NVD database
Technical Details for CVE-2025-0114
Vulnerability Analysis
This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the GlobalProtect service fails to properly limit the allocation of resources when processing incoming network packets. The attack requires network access and involves sending specially crafted packets to the GlobalProtect portal or gateway over an extended period.
The vulnerability does not require authentication, meaning any attacker with network access to the GlobalProtect service can attempt exploitation. While the attack complexity is elevated due to the sustained nature of the packet flood required, successful exploitation results in complete service unavailability. The attack does not compromise data confidentiality or integrity but severely impacts service availability.
Root Cause
The root cause stems from improper resource management within the GlobalProtect feature's packet processing logic. When the service receives a large volume of specially crafted packets, it fails to implement adequate throttling or rate-limiting mechanisms, leading to resource exhaustion. This allows an attacker to consume available resources faster than the system can release them, ultimately causing service degradation or complete denial of service.
Attack Vector
The attack is network-based and targets the GlobalProtect portal and gateway services that are typically exposed to the internet to support remote VPN connectivity. An attacker would need to:
- Identify a target GlobalProtect service endpoint
- Craft malicious packets designed to trigger resource consumption
- Sustain the attack over a period of time to exhaust available resources
- Maintain the attack to prevent service recovery
The vulnerability requires no authentication or user interaction, making it particularly concerning for internet-facing GlobalProtect deployments. Organizations should refer to the Palo Alto Networks Security Advisory for detailed technical specifications regarding the packet structure and attack patterns.
Detection Methods for CVE-2025-0114
Indicators of Compromise
- Unusual spike in connection attempts or packet volume to GlobalProtect portal or gateway ports (typically TCP 443)
- GlobalProtect service becoming unresponsive or intermittently unavailable
- System resource exhaustion (CPU, memory, or connection table) on firewall appliances
- Increased error logs related to GlobalProtect service processing failures
Detection Strategies
- Configure alerting for abnormal traffic patterns targeting GlobalProtect endpoints
- Monitor firewall system resource utilization (CPU, memory, session tables) for unusual consumption patterns
- Implement network traffic analysis to detect sustained high-volume packet floods from single or distributed sources
- Review GlobalProtect service logs for repeated connection failures or processing errors
Monitoring Recommendations
- Enable detailed logging for GlobalProtect portal and gateway components
- Set up threshold-based alerts for connection rates to GlobalProtect services
- Deploy network monitoring tools to baseline normal traffic patterns and detect anomalies
- Configure SIEM rules to correlate GlobalProtect service disruptions with potential attack indicators
How to Mitigate CVE-2025-0114
Immediate Actions Required
- Review the Palo Alto Networks Security Advisory for specific remediation guidance
- Assess exposure of GlobalProtect services to untrusted networks
- Implement network-level rate limiting for GlobalProtect endpoints where possible
- Consider geographic IP filtering if GlobalProtect users are from known regions
Patch Information
Palo Alto Networks has released security updates to address this vulnerability. Organizations should consult the official Palo Alto Networks Security Advisory for specific patch versions and upgrade paths. Multiple versions of PAN-OS are affected, including various 10.1.14 hotfix releases, requiring organizations to update to the latest patched version.
Workarounds
- Deploy upstream DDoS protection services to filter malicious traffic before it reaches GlobalProtect endpoints
- Implement network access controls to limit GlobalProtect exposure to trusted IP ranges where feasible
- Configure zone protection profiles with flood protection settings to mitigate volumetric attacks
- Consider using Prisma Access or Cloud NGFW alternatives which are not affected by this vulnerability
# Example: Configure zone protection profile for GlobalProtect zone
# Access the firewall CLI and configure flood protection thresholds
# Consult Palo Alto Networks documentation for specific values appropriate to your environment
set zone <zone-name> zone-protection-profile <profile-name>
set zone-protection-profile <profile-name> flood tcp-syn enable yes
set zone-protection-profile <profile-name> flood tcp-syn activate-rate <threshold>
set zone-protection-profile <profile-name> flood tcp-syn maximum-rate <max-rate>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
