Is CVE-2026-0327 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0327 being exploited in the wild.

How severe is CVE-2026-0327?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1; Palo Alto Networks Prisma Access 11.2, 12.1 through 12.1.10-h3.

How is CVE-2026-0327 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-0327?

Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0327: Palo Alto Networks PAN-OS privilege escalation in GlobalProtect

CVE-2026-0327 · Severity: info · Published 2026-11-11

PAN-OS firewalls running GlobalProtect gateways with RADIUS-based authentication are vulnerable to privilege escalation. An authenticated user with lower privileges can obtain the configuration and privileges of a higher-privileged administrator account. This could lead to complete firewall compromise and exposure of sensitive network security policies.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0327 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0327 being exploited in the wild.
How severe is CVE-2026-0327?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1; Palo Alto Networks Prisma Access 11.2, 12.1 through 12.1.10-h3.
Is there a fix for CVE-2026-0327?: Yes: fixed in PAN-OS 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2; Prisma Access 12.1.10-h4. Until then: Change the GlobalProtect gateway authentication profile from a RADIUS challenge-based profile to a non-challenge profile such as SAML, or enforce client certificate authentication instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0327 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0327?: Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PAN-OS 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2; Prisma Access 12.1.10-h4

Change the GlobalProtect gateway authentication profile from a RADIUS challenge-based profile to a non-challenge profile such as SAML, or enforce client certificate authentication instead.

Technical details

A privilege escalation flaw in the GlobalProtect gateway component allows an authenticated attacker with low privileges to escalate to administrator level when a RADIUS authentication profile with supported challenges is configured. The vulnerability requires network access and valid user credentials; no user interaction or special permissions are needed. An attacker gains administrative configuration access, including secrets and security policies.

Affected products

Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1
Palo Alto Networks Prisma Access 11.2, 12.1 through 12.1.10-h3

Timeline

2026-11-11: disclosed

References

https://security.paloaltonetworks.com/CVE-2026-0327

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.