PAN-OS Fixes GlobalProtect Third-Party VPN Client Authentication Bypass
Tech GuruQuick Answer
Check whether third-party VPN clients are enabled, install the matching fixed PAN-OS maintenance build and validate both permitted connections and rejected unauthorized attempts.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Confirm the portal and gateway configuration allows third-party VPN clients. Match the exact maintenance release to the vendor table; do not apply a single threshold across every branch. Use the fixed maintenance version listed for the installed branch or another supported fixed upgrade target. Palo Alto Networks lists no workaround. Verify the running build, test authorized client interoperability and authentication enforcement, and review unusual VPN sessions and configuration changes.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS GlobalProtect portals and gateways allowing third-party VPN clients |
|---|---|
| Advisory | CVE-2026-0328 |
| CVE | CVE-2026-0328 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 at the vulnerable maintenance builds listed below, only where third-party VPN clients are enabled. Deployments using only GlobalProtect or Prisma Access Agent clients are not impacted. Panorama, Cloud NGFW and Prisma Access are unaffected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; PAN-OS 10.2.18-h14 for the 10.2 branch; alternate maintenance fixes are listed below |
| CVSS base score | 7.0 (CVSS v4.0 base score) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
An unauthenticated user can bypass portal or gateway security restrictions and establish an unauthorized VPN connection when third-party VPN client use is enabled.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Confirm the portal and gateway configuration allows third-party VPN clients. Match the exact maintenance release to the vendor table; do not apply a single threshold across every branch.
- Remediate. Use the fixed maintenance version listed for the installed branch or another supported fixed upgrade target. Palo Alto Networks lists no workaround.
- Validate. Verify the running build, test authorized client interoperability and authentication enforcement, and review unusual VPN sessions and configuration changes.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve portal, gateway and authentication logs. Plan high-availability and remote-access continuity; the advisory does not establish exploitation or customer compromise.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.4-h14; < 12.1.7-h12; < 12.1.10-h4 | >= 12.1.4-h14; >= 12.1.7-h12; >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.4-h24; < 11.2.7-h24; < 11.2.10-h18; < 11.2.13-h5; < 11.2.16-h2 | >= 11.2.4-h24; >= 11.2.7-h24; >= 11.2.10-h18; >= 11.2.13-h5; >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.4-h39; < 11.1.6-h41; < 11.1.7-h13; < 11.1.10-h37; < 11.1.13-h17; < 11.1.16-h5 | >= 11.1.4-h39; >= 11.1.6-h41; >= 11.1.7-h13; >= 11.1.10-h37; >= 11.1.13-h17; >= 11.1.16-h5 |
| PAN-OS 10.2 | < 10.2.7-h40; < 10.2.10-h43; < 10.2.13-h28; < 10.2.16-h13; < 10.2.18-h14 | >= 10.2.7-h40; >= 10.2.10-h43; >= 10.2.13-h28; >= 10.2.16-h13; >= 10.2.18-h14 |
| Prisma Access | None | All |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
