Palo Alto Networks PAN-OS: GlobalProtect Privilege Escalation (CVE-2026-0327)
A privilege escalation vulnerability in the GlobalProtect gateway of PAN-OS allows an authenticated, lower-privileged user to gain higher-privileged access when using RADIUS-based authentication challenges (CVE-2026-0327).
CVE search metadata
CVE search record: CVE-2026-0327. KEV: no. Product: PAN-OS (< 12.2.4-h2), PAN-OS (< 12.1.10-h4), PAN-OS (< 11.2.16-h2), PAN-OS (< 11.1.16-h5), Prisma Access (< 12.1.10-h4). Brief: Palo Alto Networks PAN-OS: GlobalProtect Privilege Escalation (CVE-2026-0327). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pan-os-globalprotect-priv-esc-cve-2026-0327/
Triage facts
Revision 1- Applicability
- PAN-OS (< 12.2.4-h2), PAN-OS (< 12.1.10-h4) +3
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 21:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unlikely
A privilege escalation vulnerability exists in the GlobalProtect gateway of Palo Alto Networks PAN-OS software. The issue allows an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user. This vulnerability specifically affects firewalls with a GlobalProtect gateway configured to use an authentication profile that utilizes a RADIUS provider and issues a supported authentication challenge. Palo Alto Networks is not aware of any malicious exploitation of this issue. Cloud NGFW and Panorama are not affected.
Impact
Successful exploitation allows an authenticated user to gain elevated privileges and access sensitive configuration data, potentially leading to unauthorized administrative control within the context of the GlobalProtect gateway.
Recommendation
- Apply the vendor-provided patches for PAN-OS and Prisma Access immediately.
- If patching is not immediately feasible, change the GlobalProtect authentication profile to a non-challenge based method such as SAML, or enforce client certificate authentication using a Certificate Profile to mitigate the vulnerability.
Immediate actions
Inventory all PAN-OS and Prisma Access deployments to identify versions vulnerable to CVE-2026-0327.
Audit GlobalProtect Gateway configurations to identify RADIUS-based authentication profiles currently in use.
Update PAN-OS to 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5 or later as applicable.
Threat Hunt
Identify users authenticated via GlobalProtect with a RADIUS authentication profile who subsequently perform administrative actions or access configuration objects that typically require higher privileges. Look for discrepancies between the user's assigned role and the scope of their authenticated requests.
Data: GlobalProtect access logs, PAN-OS management interface audit logs, Authentication profile configuration audit
Mitigations
Change the Authentication Profile on GlobalProtect Gateways to a non-challenge profile (e.g., SAML) or enforce Certificate-based authentication.
CVE-2026-0327