Is CVE-2026-0328 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0328 being exploited in the wild.

How severe is CVE-2026-0328?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Palo Alto Networks PAN-OS 10.2.0 through 10.2.18-h*, 11.1.0 through 11.1.16-h*, 11.2.0 through 11.2.16-h*, 12.1.2 through 12.1.10-h*, 12.2.0 through 12.2.4-h*.

Is there a fix for CVE-2026-0328?

Yes: fixed in PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 12.2.4-h2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0328 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-0328?

Check whether you run Palo Alto Networks PAN-OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0328: Palo Alto Networks PAN-OS authentication bypass in GlobalProtect

CVE-2026-0328 · Severity: info · Published 2026-11-11

Palo Alto Networks PAN-OS firewalls with GlobalProtect VPN allow unauthenticated users to bypass security controls and establish unauthorized VPN connections. This affects organizations that enable third-party VPN clients on their GlobalProtect gateway or portal, potentially allowing unauthorized remote access to corporate networks and sensitive data.

Technologies: Palo Alto Networks PAN-OS. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0328 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0328 being exploited in the wild.
How severe is CVE-2026-0328?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Palo Alto Networks PAN-OS 10.2.0 through 10.2.18-h*, 11.1.0 through 11.1.16-h*, 11.2.0 through 11.2.16-h*, 12.1.2 through 12.1.10-h*, 12.2.0 through 12.2.4-h*.
Is there a fix for CVE-2026-0328?: Yes: fixed in PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 12.2.4-h2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0328 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0328?: Check whether you run Palo Alto Networks PAN-OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 12.2.4-h2

Technical details

The vulnerability enables user impersonation through improper authentication in the GlobalProtect portal and gateway components, allowing an unauthenticated attacker to establish an unauthorized VPN connection over the network. The issue requires that third-party VPN clients are enabled; customers using only the native GlobalProtect client or Prisma Access Agent are unaffected. Exploitation results in HIGH impact to confidentiality and integrity of subsequent VPN sessions.

Affected products

Palo Alto Networks PAN-OS 10.2.0 through 10.2.18-h*, 11.1.0 through 11.1.16-h*, 11.2.0 through 11.2.16-h*, 12.1.2 through 12.1.10-h*, 12.2.0 through 12.2.4-h*

Timeline

2026-11-11: disclosed

References

https://security.paloaltonetworks.com/CVE-2026-0328

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.