PAN-OS Fixes GlobalProtect RADIUS Challenge Privilege Escalation
Tech GuruQuick Answer
Identify GlobalProtect gateways using RADIUS challenges, apply the supported PAN-OS fix and verify role-specific access. Coordinate Prisma Access upgrades and retain authentication-policy evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Trace each gateway Client Authentication entry to its Authentication Profile and RADIUS Server Profile. Confirm whether the provider issues the affected authentication challenge. Upgrade the installed PAN-OS branch. The vendor permits a non-challenge profile such as SAML or enforced client-certificate authentication as a mitigation. Arrange Prisma Access maintenance with support. Test successful and rejected authentication with controlled low- and high-privilege accounts and confirm the correct user configuration and network permissions.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS GlobalProtect gateways using RADIUS challenge authentication, and affected Prisma Access releases |
|---|---|
| Advisory | CVE-2026-0327 |
| CVE | CVE-2026-0327 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | PAN-OS 12.2, 12.1, 11.2 and 11.1 before the fixed builds below, where GlobalProtect uses a RADIUS authentication profile issuing a supported challenge. Prisma Access 12.1 before 12.1.10-h4 and Prisma Access 11.2 are affected. Cloud NGFW and Panorama are unaffected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; Prisma Access 12.1.10-h4 or later |
| CVSS base score | 6.0 (CVSS v4.0 base score) |
| CVSS severity | Medium |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
An authenticated user with lower privileges can obtain another user’s higher privileges and configuration through the affected GlobalProtect RADIUS challenge flow.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Trace each gateway Client Authentication entry to its Authentication Profile and RADIUS Server Profile. Confirm whether the provider issues the affected authentication challenge.
- Remediate. Upgrade the installed PAN-OS branch. The vendor permits a non-challenge profile such as SAML or enforced client-certificate authentication as a mitigation. Arrange Prisma Access maintenance with support.
- Validate. Test successful and rejected authentication with controlled low- and high-privilege accounts and confirm the correct user configuration and network permissions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Authentication changes can lock out remote users. Keep approved recovery access, coordinate identity-provider dependencies and retain RADIUS and VPN logs.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.10-h4 | >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.16-h2 | >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.16-h5 | >= 11.1.16-h5 |
| Prisma Access 12.1 | < 12.1.10-h4* | >= 12.1.10-h4* |
| Prisma Access 11.2 | All* | None* |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
