UpHeron
All vulnerabilities

Servers and applications

CVE-2026-0325

PAN-OS: GlobalProtect Authorization Bypass Vulnerability

Severity
Low 1.3
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2
Weakness
CWE-940
Attack
Over the network · Needs a user account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber
Sources
CVE Program

Description

An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.

Cloud NGFW is not affected by this vulnerability.

From the CVE Program.

Affected software

SoftwareAffected versions
Palo Alto Networks PAN-OSServers and applications · cna:palo alto networks|pan-os
  • From 11.1.0 before 11.1.16-h5
  • From 11.2.0 before 11.2.16-h2
  • From 12.1.0 before 12.1.10-h4
  • From 12.2.0 before 12.2.4-h2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-0325