Improper Verification of Source of a Communication Channel in Palo Alto PAN-OS and Prisma Access - CVE-2026-0325

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU166079

Improper Verification of Source of a Communication Channel in Palo Alto PAN-OS and Prisma Access - CVE-2026-0325

Published: November 12, 2026


Vulnerability identifier: #VU166079
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-0325
CWE-ID: CWE-940
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.

The vulnerability exists due to improper verification of the source of a communication channel in the GlobalProtect gateway of Palo Alto Networks PAN-OS when handling network traffic. A remote user can use valid GlobalProtect credentials and misrepresent the source of traffic to bypass source IP-based access controls.

Exposure is limited to PAN-OS firewall configurations with a GlobalProtect gateway enabled.


Affected software

Palo Alto PAN-OS
Prisma Access

How to mitigate CVE-2026-0325

Install security update from vendor's website.

Palo Alto PAN-OS - addressed in versions 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2
Prisma Access - update to 12.1.10-h4

External References

Related Security Bulletins