CVE-2026-0325: Authorization Bypass in Palo Alto Networks PAN-OS GlobalProtect
A critical authorization bypass vulnerability (CVE-2026-0325) affects Palo Alto Networks PAN-OS GlobalProtect VPN functionality across multiple releases including 11.1.x through 12.2.x versions. This flaw allows authenticated attackers to bypass access controls, potentially gaining unauthorized access to protected network resources. The vulnerability impacts a wide range of PAN-OS versions starting from 11.1.0 up to 12.2.4, affecting both H (hardware) and non-H releases. Palo Alto Networks has issued security advisories detailing the issue and providing fixed PAN-OS versions to mitigate the risk. This bypass could reduce the effectiveness of VPN security and may be leveraged in targeted attacks.
Entenda a falha
A vulnerabilidade
CVE-2026-0325 is an authorization bypass in the GlobalProtect VPN function of Palo Alto Networks PAN-OS. The story says an authenticated user can get around the expected authorization policies and reach protected network resources they should not have. Affected releases run from PAN-OS 11.1.0 through 12.2.4, including 11.2.x and 12.1.x and the hotfix (H) builds. The story does not give the fixed version numbers. Palo Alto Networks says it has published fixed PAN-OS versions for every affected branch in its advisory.
Como funciona
The articles give little detail on the mechanism. A user first authenticates to GlobalProtect, and the PAN-OS authorization logic then decides which network resources that user may reach. The story says that in the vulnerable releases an authenticated user can circumvent those authorization policies and obtain access beyond what was intended. The exact step where the check fails is not described.
Por que é vulnerável
The vendor classifies the flaw as an authorization bypass in the GlobalProtect authorization mechanisms, meaning access controls are not enforced as intended after authentication. The articles do not give the specific root cause, why it went unnoticed, or the code-level change in the fix. The fix is the updated PAN-OS releases.
Como foi descoberta
The articles do not say who found the flaw or how. They only say Palo Alto Networks published a security advisory for CVE-2026-0325 on 2026-11-11 listing the affected PAN-OS versions, with fixed releases.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 14:17.
Detalhes técnicos
The vulnerability appears in the GlobalProtect authorization mechanisms within PAN-OS, enabling an authenticated user to circumvent expected authorization policies. Palo Alto Networks classifies this as an authorization bypass, meaning the issue requires authentication but allows elevation beyond intended privileges.
Detalhes da correção
Palo Alto Networks released updated PAN-OS versions patching this vulnerability across all impacted branches from 11.1.x to 12.2.x. Administrators are advised to upgrade to these patched versions immediately to prevent exploitation.
Remediação
Apply the vendor provided PAN-OS updates that address CVE-2026-0325. Review GlobalProtect configurations and monitoring to detect any suspicious authenticated activity indicative of exploitation attempts.
Linha do tempo
-
CVE-2026-0325: Authorization Bypass in Palo Alto Networks PAN-OS GlobalProtect
ler a análise desta fonte ocultar
A critical authorization bypass vulnerability (CVE-2026-0325) affects Palo Alto Networks PAN-OS GlobalProtect VPN functionality across multiple releases including 11.1.x through 12.2.x versions. This flaw allows authenticated attackers to bypass access controls, potentially gaining unauthorized access to protected network resources. The vulnerability impacts a wide range of PAN-OS versions starting from 11.1.0 up to 12.2.4, affecting both H (hardware) and non-H releases. Palo Alto Networks has issued security advisories detailing the issue and providing fixed PAN-OS versions to mitigate the risk. This bypass could reduce the effectiveness of VPN security and may be leveraged in targeted attacks.
Technical Details
The vulnerability appears in the GlobalProtect authorization mechanisms within PAN-OS, enabling an authenticated user to circumvent expected authorization policies. Palo Alto Networks classifies this as an authorization bypass, meaning the issue requires authentication but allows elevation beyond intended privileges.
Fix Details
Palo Alto Networks released updated PAN-OS versions patching this vulnerability across all impacted branches from 11.1.x to 12.2.x. Administrators are advised to upgrade to these patched versions immediately to prevent exploitation.
Remediation
Apply the vendor provided PAN-OS updates that address CVE-2026-0325. Review GlobalProtect configurations and monitoring to detect any suspicious authenticated activity indicative of exploitation attempts.