Is CVE-2026-0319 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0319 being exploited in the wild.

How severe is CVE-2026-0319?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Palo Alto Networks PAN-OS 12.2.0–12.2.3; 12.1.0–12.1.10-h*; 11.2.0–11.2.15; 11.1.0–11.1.16-h*; 10.2.0–10.2.18-h*; Palo Alto Networks Prisma Access 12.1.0–12.1.7-h7; 11.2.0–11.2.7-h20; 10.2.0–10.2.10-h40; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.

Is there a fix for CVE-2026-0319?

Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0319 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-0319?

Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0319: Palo Alto Networks PAN-OS GlobalProtect session hijacking

CVE-2026-0319 · Severity: info · Published 2026-10-14

Palo Alto Networks PAN-OS is firewall software that protects corporate networks through VPN and network access control. An authenticated user can exploit improper input handling in the GlobalProtect gateway to hijack another user's VPN session, gaining access to network resources under a different identity without detection.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access, Siemens Ruggedcom Ape1808. Vendors: Palo Alto Networks, Siemens.

Quick answers

Is CVE-2026-0319 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0319 being exploited in the wild.
How severe is CVE-2026-0319?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Palo Alto Networks PAN-OS 12.2.0–12.2.3; 12.1.0–12.1.10-h*; 11.2.0–11.2.15; 11.1.0–11.1.16-h*; 10.2.0–10.2.18-h*; Palo Alto Networks Prisma Access 12.1.0–12.1.7-h7; 11.2.0–11.2.7-h20; 10.2.0–10.2.10-h40; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.
Is there a fix for CVE-2026-0319?: Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0319 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-0319?: Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41

Technical details

Improper input handling in the GlobalProtect gateway enables an authenticated attacker to establish a GlobalProtect session using the identity of a different user. The vulnerability requires network access and prior authentication but allows privilege escalation or lateral movement by impersonating other users. Cloud NGFW and Panorama are not affected.

Affected products

Palo Alto Networks PAN-OS 12.2.0–12.2.3; 12.1.0–12.1.10-h*; 11.2.0–11.2.15; 11.1.0–11.1.16-h*; 10.2.0–10.2.18-h*
Palo Alto Networks Prisma Access 12.1.0–12.1.7-h7; 11.2.0–11.2.7-h20; 10.2.0–10.2.10-h40
Siemens RUGGEDCOM APE1808 all versions with Palo Alto Networks Virtual NGFW

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.