CVE-2026-0325: Palo Alto Networks PAN-OS GlobalProtect authorization bypass

CVE-2026-0325 · Severity: info · Published 2026-11-11

PAN-OS GlobalProtect is a remote access gateway that enforces network access controls through IP address filtering. An authenticated attacker can bypass these IP-based restrictions to gain unauthorized access from disallowed networks. Organizations relying on source IP filtering for security will have that control circumvented for authenticated users.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0325 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0325 being exploited in the wild.
How severe is CVE-2026-0325?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1; Palo Alto Networks Prisma Access 11.2 all versions, 12.1.2 through 12.1.10-h3.
Is there a fix for CVE-2026-0325?
Yes: fixed in PAN-OS 12.2.4-h2 or later, 12.1.10-h4 or later, 11.2.16-h2 or later, 11.1.16-h5 or later; Prisma Access 12.1.10-h4 or later. Until then: Limit access to GlobalProtect services using DoS protection policies, country-based access restrictions, and IP blocklists. See Palo Alto Networks guidance on limiting unnecessary exposure to the internet for detailed configuration steps. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0325 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0325?
Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: PAN-OS 12.2.4-h2 or later, 12.1.10-h4 or later, 11.2.16-h2 or later, 11.1.16-h5 or later; Prisma Access 12.1.10-h4 or later

Limit access to GlobalProtect services using DoS protection policies, country-based access restrictions, and IP blocklists. See Palo Alto Networks guidance on limiting unnecessary exposure to the internet for detailed configuration steps.

Technical details

An authorization bypass flaw in the GlobalProtect gateway component allows an authenticated attacker with valid credentials to circumvent IP address restrictions and source IP filtering controls. The vulnerability requires the GlobalProtect gateway to be configured and an attacker to possess legitimate authentication credentials; exploitation occurs over the network. A fix has been released across affected PAN-OS versions.

Affected products

  • Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1
  • Palo Alto Networks Prisma Access 11.2 all versions, 12.1.2 through 12.1.10-h3

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.