CVE-2026-0328Low· 2.7▾ Sunlit

PAN-OS: User Impersonation through GlobalProtect Portal

Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Panor…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score15/ 100 · Minimal

impact 14.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 11, 2026

Updated

Nov 11, 2026

CVSS

2.7

Vendor

Palo Alto Networks

Product

Cloud NGFW

CWE

CWE-287

Depth score

15 · Minimal

EPSS

0.57% · p48

Platforms

—

Source

CVEORG

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 1 day

Nov 11, 2026Published
Disclosed via CVEORG
Nov 12, 2026EPSS first tracked
0.6%

Palo Alto Networks CWE-287 #cve.org

Affected

cloud_ngfw
PAN-OS >= 12.2.0 < 12.2.4-h2
PAN-OS >= 12.1.0 < 12.1.10-h4
PAN-OS >= 11.2.0 < 11.2.16-h2
PAN-OS >= 11.1.0 < 11.1.16-h5
PAN-OS >= 10.2.0 < 10.2.18-h14
prisma_access

Full technical detail▾

Overview

Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.

Affected

cloud_ngfw
PAN-OS >= 12.2.0 < 12.2.4-h2
PAN-OS >= 12.1.0 < 12.1.10-h4
PAN-OS >= 11.2.0 < 11.2.16-h2
PAN-OS >= 11.1.0 < 11.1.16-h5
PAN-OS >= 10.2.0 < 10.2.18-h14
prisma_access

Remediation

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h12 or 12.1.10-h4 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h14 or 12.1.10-h4 or later. PAN-OS 11.2 11.2.15 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h14 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h43 or 10.2.18-h14 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h40 or 10.2.18-h14 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Workarounds

No known workarounds exist for this issue.

References

https://security.paloaltonetworks.com/CVE-2026-0328

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org