CVE-2021-3064

—

CVSS 3.1

9.8 critical

EPSS

20%p97

Published

Nov 10, 2021 (Nov 10, 2021)

Modified

Jun 17, 2026

Description

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the GlobalProtect interface to exploit this issue. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. Prisma Access customers are not impacted by this issue.

Vendors: paloaltonetworks
Products: pan-os
Weakness: CWE-121, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (20.1%)

In the news4 stories

Palo Alto Warns of Zero-Day Bug in Firewalls Using GlobalProtect Portal VPN

The Hacker NewsNov 15, 00:00 UTC · Nov 15, 2021Exploit / PoC CVE-2021-3064

Week in review: Critical RCE in Palo Alto Networks firewalls, how to select a DRaaS solution

Help Net SecurityNov 14, 00:00 UTC · Nov 14, 2021Vulnerability in the wildCVE-2021-3064 CVE-2021-42321 CVE-2021-42292

Critical RCE in Palo Alto Networks (PAN) firewalls revealed, patch ASAP! (CVE-2021-3064)

Help Net SecurityNov 12, 00:00 UTC · Nov 12, 2021Vulnerability in the wildCVE-2021-3064

CVE-2021-3064: Easily exploitable RCE flaw in Palo Alto Networks in GlobalProtect VPN

Security AffairsNov 11, 09:30 UTC · Nov 11, 2021Vulnerability CVE-2021-3064