# CVE-2026-0327: Palo Alto Networks PAN-OS privilege escalation in GlobalProtect

Source: https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-0327 · Severity: info · Published 2026-11-11

PAN-OS firewalls running GlobalProtect gateways with RADIUS-based authentication are vulnerable to privilege escalation. An authenticated user with lower privileges can obtain the configuration and privileges of a higher-privileged administrator account. This could lead to complete firewall compromise and exposure of sensitive network security policies.

Technologies: [Palo Alto Networks PAN-OS](https://junglewise.ai/threats/technologies/pan-os), [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0327 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0327 being exploited in the wild.

**How severe is CVE-2026-0327?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1; Palo Alto Networks Prisma Access 11.2, 12.1 through 12.1.10-h3.

**Is there a fix for CVE-2026-0327?** Yes: fixed in PAN-OS 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2; Prisma Access 12.1.10-h4. Until then: Change the GlobalProtect gateway authentication profile from a RADIUS challenge-based profile to a non-challenge profile such as SAML, or enforce client certificate authentication instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0327 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-0327?** Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PAN-OS 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2; Prisma Access 12.1.10-h4

Change the GlobalProtect gateway authentication profile from a RADIUS challenge-based profile to a non-challenge profile such as SAML, or enforce client certificate authentication instead.

## Technical details

A privilege escalation flaw in the GlobalProtect gateway component allows an authenticated attacker with low privileges to escalate to administrator level when a RADIUS authentication profile with supported challenges is configured. The vulnerability requires network access and valid user credentials; no user interaction or special permissions are needed. An attacker gains administrative configuration access, including secrets and security policies.

## Affected products

- Palo Alto Networks PAN-OS 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1
- Palo Alto Networks Prisma Access 11.2, 12.1 through 12.1.10-h3

## Timeline

- 2026-11-11: disclosed

## References

- [https://security.paloaltonetworks.com/CVE-2026-0327](https://security.paloaltonetworks.com/CVE-2026-0327)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS authentication bypass in GlobalProtect](https://junglewise.ai/threats/cve-2026-0328-authentication-bypass-vulnerabilities-in-the-globalprotect-portal)
- [Palo Alto Networks PAN-OS buffer overflow in protocol and service processing](https://junglewise.ai/threats/cve-2026-0326-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS GlobalProtect authorization bypass](https://junglewise.ai/threats/cve-2026-0325-an-authorization-bypass-vulnerability-in-the-globalprotect-gateway)