GlobalProtect RADIUS Challenge Path Underlies PAN-OS CVE-2026-0327

CVE-2026-0327 is a privilege escalation issue in the GlobalProtect gateway of PAN-OS. Palo Alto Networks says an authenticated, lower-privileged user can obtain the privileges and configuration of a higher-privileged user. The vulnerability is exposed when a GlobalProtect gateway uses a RADIUS authentication profile that issues a supported authentication challenge.

The vendor published the advisory on November 11, 2026. Cloud NGFW and Panorama are not affected. Palo Alto Networks reported no awareness of malicious exploitation.

Why the configuration condition is central

The rating data is easy to misread. The CVSS 4.0 base score is 6.0, but the vendor's threat score is 2.3. The threat score reflects low reported exploit maturity and specific attack requirements. The base score still describes a network-reachable integrity and privilege boundary.

Administrators should inventory every GlobalProtect gateway, then follow the client authentication reference to its authentication profile. Confirm whether that profile uses a RADIUS server profile and whether the server can issue a supported challenge. A gateway that uses SAML or a certificate profile is not exposed through the same path.

Affected releases

The affected PAN-OS ranges were below 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5. Fixed releases are the same listed hotfix levels. Prisma Access 12.1 before 12.1.10-h4 was affected and is scheduled for vendor maintenance; Prisma Access 11.2 was listed as affected in full. Older unsupported PAN-OS versions need an upgrade to a supported fixed release.

Mitigation without breaking access

Palo Alto Networks recommends changing the gateway's client authentication to a non-challenge profile, such as SAML, or assigning a certificate profile to enforce client certificate authentication. These changes affect the login experience and may require identity-provider coordination.

Test the change with a small set of users and devices before committing it to all gateways. Record the previous authentication profile so the rollback path is explicit. A temporary mitigation should have an owner, an expiry date, and a monitoring check that confirms the intended profile remains active.

Privilege review

This vulnerability concerns privilege and configuration access after authentication. Review the roles assigned to GlobalProtect users, the configuration scopes available to those roles, and the accounts that can change gateway authentication profiles.

Look for unusual changes to administrator roles, configuration exports, and authentication profile references during the exposure window. A successful exploit may appear as legitimate authenticated activity, so identity logs and management-plane audit logs need to be joined by user, source address, and time.

Response checklist

  1. Inventory all GlobalProtect gateways and their client authentication profiles.
  2. Identify RADIUS-backed, challenge-capable profiles.
  3. Patch to the fixed release or apply the vendor mitigation.
  4. Confirm the running release on every firewall and HA peer.
  5. Rotate credentials if management audit or configuration access suggests compromise.

The issue does not justify removing GlobalProtect from service without evidence. It does require knowing which gateways depend on the vulnerable authentication behavior and which administrators could be reached through the resulting privilege boundary.

References