CVE-2026-0227: Palo Alto Networks, 원격 방화벽 중단을 초래하는 GlobalProtect DoS 결함 수정

Daryna Olyniychuk 마케팅 팀 리드

팔로우

Add to my AI research

Microsoft의 대규모 1월 Patch Tuesday 릴리스가 해결한 지 얼마 지나지 않아 CVE-2026-20805 Windows Desktop Window Manager의 제로데이 취약점이 또 다른 기술 거대 기업에 보안 패치를 발행하도록 했습니다. 이번에는 Palo Alto Networks가 GlobalProtect Gateway 및 Portal에 영향을 미치는 높은 심각도의 결함을 경고하며, 개념 증명(Proof-of-Concept, PoC) 익스플로잇이 이미 제공되고 있다고 알렸습니다.

GlobalProtect는 Palo Alto Networks의 VPN 및 안전한 원격 액세스 플랫폼입니다. 사용자는 Palo Alto 방화벽을 통해 트래픽을 전달하여 조직의 네트워크에 안전하게 연결할 수 있으며, 방화벽은 기업 네트워크 내에서 사용하는 동일한 보안 정책과 보호 기능을 강제합니다.

CVE-2026-0227로 알려진 이 문제는 예외 조건에 대한 적절한 검사가 부족하여 발생하는 GlobalProtect PAN-OS 소프트웨어의 서비스 거부(DoS) 취약점입니다. 이 취약점은 인증되지 않은 공격자가 방화벽을 중단시킬 수 있으며, 반복적인 익스플로잇은 장치를 유지보수 모드로 강제할 수 있습니다.

보안 팀이 CVE-2026-0227과 같은 위협을 빠르게 탐지하고 대응할 수 있도록 관련 탐지 정보와 규칙에 즉시 접근하는 것이 중요합니다. SOC Prime의 AI-네이티브 탐지 인텔리전스 플랫폼 은 SOC 팀에게 진보된 기술과 전문가 수준의 사이버보안 통찰력을 제공하여 위협에 선제적으로 대응하고 조직의 회복력을 강화합니다. 클릭하여 탐지 탐색을 통해 취약점 익스플로잇을 다루는 종합적인 탐지 콘텐츠 라이브러리에 접근할 수 있으며, 맞춤형 “CVE” 태그를 사용하여 쉽게 필터링할 수 있습니다.

탐지 탐색

이 전용 규칙 집합의 탐지는 여러 SIEM, EDR, 데이터 레이크 플랫폼과 호환되며, 최신 MITRE ATT&CK® 프레임워크 v18.1에 완전히 매핑되어 있습니다. 보안 팀은 또한 Uncoder AI 를 활용하여 위협 보고서에서 자동으로 규칙을 생성하고, 논리를 개선 및 검증하며, 공격 흐름을 시각화하고, IOC를 맞춤형 사냥 쿼리로 변환하고, 감지 코드를 여러 언어로 즉시 번역할 수 있습니다.

CVE-2026-0227 분석

2026년 1월 14일, Palo Alto Networks는 자문 을 발표하여 인증되지 않은 공격자가 서비스 거부(DoS) 공격을 통해 방화벽 보호 기능을 비활성화할 수 있는 높은 심각도의 취약점에 대해 사용자에게 경고했습니다.

CVE-2026-0227로 추적되는 이 보안 결함은 CVSS 점수가 7.7이며, PAN-OS 10.1 이상을 실행하는 차세대 방화벽과 GlobalProtect 게이트웨이 또는 포털이 활성화될 때 Palo Alto Networks의 Prisma Access 구성에 영향을 미칩니다. 회사에 따르면 대부분의 클라우드 기반 Prisma Access 인스턴스가 이미 패치된 상태이며, 나머지 시스템은 업데이트가 예정되어 있습니다.

Shadowserver는 현재 약 6,000대의 Palo Alto Networks 방화벽이 온라인에 노출되어 있으며, 이 중 얼마나 많은 장치가 여전히 취약하거나 이미 안전하게 수정되었는지는 명확하지 않다고 지적합니다. 자문 발표 당시, Palo Alto Networks는 활동적인 익스플로잇 증거나 있지만 개념 증명(PoC) 익스플로잇이 이미 존재한다는 사실을 보고했습니다.

CVE-2026-0227과 같은 결함은 공격자가 인증 없이 중요한 방화벽 보호 기능을 중단할 수 있으므로 특히 위험합니다. 이는 조직을 후속 공격이나 네트워크 침해에 노출될 수 있게 하며, 즉각적인 패치가 서비스 중단을 예방하고 후속 침입 위험을 줄이기 위해 필수적입니다. 다음을 활용하십시오 SOC Prime 플랫폼 세계 최대 탐지 인텔리전스 데이터셋에 접속하고, 탐지부터 시뮬레이션에 이르는 엔드투엔드 파이프라인을 도입하여 보안 운영을 간소화하고 대응 워크플로를 가속화하며, 엔지니어링 오버헤드를 줄이고, 항상 새로운 위협보다 앞서 나갈 수 있도록 하십시오.

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.

CVE-2026-0227: Palo Alto Networks, 원격 방화벽 중단을 초래하는 GlobalProtect DoS 결함 수정

CVE-2026-0227 분석

More 최신 위협 Articles