Palo Alto Networks patches GlobalProtect identity spoofing flaw in PAN-OS

Palo Alto Networks has released an advisory for CVE-2026-0319, a medium-severity vulnerability in its PAN-OS software. The flaw resides in the GlobalProtect gateway component and allows an authenticated user to establish a session using another user’s identity. The vendor rates the issue as moderate urgency.

The vulnerability stems from improper input handling within the GlobalProtect service. According to the Palo Alto Networks PSIRT advisory, an attacker with valid credentials can exploit this defect to impersonate a different user. This could allow unauthorized access to resources associated with the targeted identity. The company states it is not aware of any malicious exploitation of this issue in the wild.

Context and Background

The Common Vulnerability Scoring System (CVSS) base score for CVE-2026-0319 is 7.6, while the base threat score is 4.9. The CVSS vector indicates that the attack requires a network origin and low complexity, but it demands some privileges and no user interaction. The flaw is classified under CWE-754, which covers improper checks for unusual or exceptional conditions.

Palo Alto Networks explicitly states that Cloud NGFW and Panorama products are not affected by this vulnerability. This distinction is critical for administrators managing mixed environments, as the risk is isolated to specific PAN-OS installations running the GlobalProtect gateway. No special configuration is required for a system to be vulnerable, meaning default setups are at risk if the software version is outdated.

Who is affected

A wide range of PAN-OS versions are vulnerable to CVE-2026-0319. Affected versions include those prior to 11.2.16, 11.1.16-h3, and 10.2.18-h12, along with specific intermediate builds in the 12.1 and 12.2 branches. The advisory lists numerous specific hotfix versions that remain vulnerable, such as 11.2.4-h22 and 10.2.7-h38.

For customers using Palo Alto Networks Prisma Access, the vendor will upgrade all accounts during the next scheduled maintenance cycle. Those requiring an immediate upgrade can contact support or account teams to schedule an on-demand window. For on-premises deployments, administrators must manually apply the relevant software updates to mitigate the risk.

What should you do?

Administrators should immediately audit their PAN-OS environments to identify any installations running vulnerable versions of the GlobalProtect gateway. If a vulnerable version is detected, apply the corresponding patch provided by Palo Alto Networks as soon as possible. Monitor authentication logs for anomalies that might indicate identity spoofing attempts.

That suggests organizations with strict compliance requirements should prioritize patching these gateways to prevent potential insider threats or credential abuse.

What to do and how to stay safe: Palo Alto Networks

• Review your inventory of PAN-OS devices to identify any running versions listed as vulnerable in the CVE-2026-0319 advisory.
• Apply the recommended software updates from Palo Alto Networks to all affected GlobalProtect gateways.
• Monitor GlobalProtect session logs for unusual authentication patterns or identity mismatches.
• Contact Palo Alto Networks support if you require an emergency upgrade for Prisma Access services.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-0319 being actively exploited?

Palo Alto Networks states it is not aware of any malicious exploitation of this vulnerability.

Are Cloud NGFW and Panorama affected?

No, the advisory explicitly states that Cloud NGFW and Panorama are not affected by this vulnerability.

What is the CVSS score for this flaw?

The CVSS base score is 7.6, and the CVSS base threat score is 4.9.