Palo Alto Networks PAN-OS: GlobalProtect Authorization Bypass (CVE-2026-0325)
An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS software allows an authenticated attacker to circumvent source IP address restrictions and network access controls.
CVE search metadata
CVE search record: CVE-2026-0325. KEV: no. Product: PAN-OS, Prisma Access. Brief: Palo Alto Networks PAN-OS: GlobalProtect Authorization Bypass (CVE-2026-0325). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pan-os-globalprotect-bypass-cve-2026-0325/
Triage facts
Revision 1- Applicability
- PAN-OS, Prisma Access
- Evidence
- Not observed
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 21:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-0325 is an authorization bypass vulnerability identified in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. The flaw allows an authenticated attacker with valid credentials to bypass source IP address restrictions and circumvent configured network access controls. This issue is applicable to PAN-OS firewall configurations with a GlobalProtect gateway enabled. Palo Alto Networks is not aware of any malicious exploitation of this issue.
Impact
Successful exploitation allows an authenticated attacker to bypass IP-based access controls intended to restrict network access, potentially leading to unauthorized access to restricted resources.
Recommendation
- Inventory systems with a GlobalProtect gateway enabled.
- Upgrade affected PAN-OS and Prisma Access instances to the versions specified by Palo Alto Networks.
- Reduce exposure by implementing DoS protection policies, country-based access restrictions, and IP blocklists.