CVE-2026-0328: PAN-OS: User Impersonation through GlobalProtect Portal (Severity: LOW)
Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection.
Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.2.4-h2Fixed in 12.1.10-h4Fixed in 12.1.7-h12Fixed in 12.1.4-h14Fixed in 11.2.16-h2Fixed in 11.2.13-h5Fixed in 11.2.10-h18Fixed in 11.2.7-h24Fixed in 11.2.4-h24Fixed in 11.1.16-h5Fixed in 11.1.13-h17Fixed in 11.1.10-h37Fixed in 11.1.7-h13Fixed in 11.1.6-h41Fixed in 11.1.4-h39Fixed in 10.2.18-h14Fixed in 10.2.16-h13Fixed in 10.2.13-h28Fixed in 10.2.10-h43Fixed in 10.2.7-h40 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.7-h40 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.18-h14 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.13-h28 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.16-h13 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.10-h43 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.4-h39 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.16-h5 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.13-h17 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.6-h41 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.7-h13 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.10-h37 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.4-h24 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.16-h2 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.13-h5 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.7-h24 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.10-h18 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.4-h14 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.10-h4 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.7-h12 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.2.4-h2
Event History
Frequently Asked Questions
Which deployments are affected?
The vulnerability affects the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS. Panorama, Cloud NGFW, and Prisma Access are not affected.
What does an attacker need to exploit this issue?
An attacker can exploit the issue without authentication to bypass security restrictions and establish an unauthorized VPN connection. The provided data does not identify any additional prerequisites.
How can I tell whether my environment is potentially exposed?
An environment is potentially exposed if it uses a GlobalProtect portal or gateway on PAN-OS. Deployments limited to Panorama, Cloud NGFW, or Prisma Access are identified as unaffected.