Prisma Access (< 12.1.10-H4) - CraftedSignal Threat Feed

Palo Alto Networks PAN-OS: Sensitive Information Disclosure (CVE-2026-0331)

hello@craftedsignal.io — Wed, 11 Nov 2026 21:54:03 +0000

Palo Alto Networks has disclosed a sensitive information disclosure vulnerability (CVE-2026-0331) in PAN-OS software. The vulnerability allows an unauthenticated remote attacker with network access to retrieve sensitive firewall and session information by sending crafted traffic to or through a dataplane interface. No special configuration is required for exposure, and the impact is higher on PA-Series and VM-Series firewalls. Panorama is not affected by this vulnerability.

Impact

Successful exploitation may allow for the exfiltration of sensitive information, including session-related data, which could facilitate further reconnaissance or network compromise. Palo Alto Networks has confirmed that the impact is lower for Prisma Access, as it requires an authenticated user and restricted external access.

Recommendation

Upgrade all affected PA-Series and VM-Series firewalls to the specified patched versions immediately.
For Prisma Access and Cloud NGFW, coordinate with Palo Alto Networks Support for scheduled maintenance or on-demand upgrades.
Inventory all currently deployed PAN-OS instances across the environment to identify systems running vulnerable versions.

Palo Alto Networks PAN-OS: GlobalProtect Privilege Escalation (CVE-2026-0327)

hello@craftedsignal.io — Wed, 11 Nov 2026 21:53:39 +0000

A privilege escalation vulnerability exists in the GlobalProtect gateway of Palo Alto Networks PAN-OS software. The issue allows an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user. This vulnerability specifically affects firewalls with a GlobalProtect gateway configured to use an authentication profile that utilizes a RADIUS provider and issues a supported authentication challenge. Palo Alto Networks is not aware of any malicious exploitation of this issue. Cloud NGFW and Panorama are not affected.

Impact

Successful exploitation allows an authenticated user to gain elevated privileges and access sensitive configuration data, potentially leading to unauthorized administrative control within the context of the GlobalProtect gateway.

Recommendation

Apply the vendor-provided patches for PAN-OS and Prisma Access immediately.
If patching is not immediately feasible, change the GlobalProtect authentication profile to a non-challenge based method such as SAML, or enforce client certificate authentication using a Certificate Profile to mitigate the vulnerability.