CVE-2026-0327: PAN-OS: Privilege Escalation Vulnerability in GlobalProtect (Severity: LOW)
A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.
Cloud NGFW and Panorama are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.2.4-h2Fixed in 12.1.10-h4Fixed in 11.2.16-h2Fixed in 11.1.16-h5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.1.10-h4 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.16-h5 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.16-h2 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.10-h4 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.2.4-h2 - Upgrade
Upgrade
Prisma Accessto a version that resolves this vulnerability.Fixed in 12.1.10-h4 - Configuration
In Network > GlobalProtect > Gateways, select the gateway, open the Authentication tab, and under Client Authentication change the Authentication Profile to a non-challenge profile such as SAML, or assign a Certificate Profile to enforce client certificate authentication; click OK and commit the changes.
GlobalProtect gateway Client Authentication = Non-challenge Authentication Profile such as SAML, or Certificate Profile authentication
Event History
Frequently Asked Questions
Who is affected by this issue?
The issue affects the GlobalProtect gateway in Palo Alto Networks PAN-OS. Cloud NGFW and Panorama are explicitly not affected; the provided information does not state whether Prisma Access deployments are affected.
What does an attacker need to exploit it?
An attacker must be authenticated and have a lower-privileged user account. No user interaction is required.
What access could an attacker gain?
A successful attacker can obtain the privileges and configuration of a higher-privileged user.