Improper Authentication in Palo Alto PAN-OS - CVE-2026-0328
Published: November 12, 2026
Vulnerability identifier: #VU166077
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-0328
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to impersonate a user, bypass security restrictions, and establish an unauthorized VPN connection.
The vulnerability exists due to improper authentication in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS when handling VPN connection requests. A remote attacker can bypass authentication to establish an unauthorized VPN connection.
Deployments using only the Global Protect client or Prisma Access Agent for VPN access are not affected.
Affected software
Palo Alto PAN-OS
How to mitigate CVE-2026-0328
Install security update from vendor's website.
Palo Alto PAN-OS - addressed in versions 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14, 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5, 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2, 12.1.4-h14, 12.1.7-h12, 12.1.10-h4, 12.2.4-h2