14/11/2026
Low Firewall & VPN
About 3 min read

Palo Alto PAN-OS: Patch CVE-2026-0325 IP address limit bypass

CVE-2026-0325 PAN-OS

Palo Alto Networks warns that CVE-2026-0325 in the PAN-OS GlobalProtect gateway lets users with valid credentials bypass IP address limits and source-IP-based access controls. Check gateway configuration and upgrade affected branches to their corresponding fixed versions.

Palo Alto PAN-OS: Patch CVE-2026-0325 IP address limit bypass

At a glance

  • CVE-2026-0325 allows an IP limit bypass in the PAN-OS GlobalProtect gateway.
  • Applies when a PAN-OS firewall has a GlobalProtect gateway configured; valid credentials are required.
  • Palo Alto Networks rates it LOW and is not aware of malicious exploitation.
  • Check the configuration and upgrade to the corresponding fixed version.
In this article

Palo Alto Networks disclosed CVE-2026-0325 in the GlobalProtect gateway, a PAN-OS component that provides remote network access. The vulnerability may let an authenticated user bypass IP address limits and access controls based on source IP filtering. See the Palo Alto Networks advisory.

Overview and technical details

This authorization bypass is identified as CVE-2026-0325. The vendor classifies its cause as CWE-940, involving improper verification of the source of a communication channel.

FieldDetails
ProductPAN-OS GlobalProtect gateway
CVECVE-2026-0325
CWECWE-940 (Improper Verification of Source of a Communication Channel)
CVSSCVSS-BT 1.3 (LOW); CVSS-B 5.3
Exploit MaturityUNREPORTED

Affected systems

The vulnerability applies when a PAN-OS firewall has a GlobalProtect gateway enabled. Cloud NGFW is not affected. The affected and corresponding fixed versions are:

Product/branchAffected versionsFixed versions
PAN-OS 12.2< 12.2.4-h212.2.4-h2 or later
PAN-OS 12.1< 12.1.10-h412.1.10-h4 or later
PAN-OS 11.2< 11.2.16-h211.2.16-h2 or later
PAN-OS 11.1< 11.1.16-h511.1.16-h5 or later
Prisma Access 12.1< 12.1.10-h412.1.10-h4 or later
Prisma Access 11.2All versions12.1.10-h4 or later
Older, unsupported PAN-OSUnsupported versionsUpgrade to a supported, fixed version

Mechanism and impact

An attacker must authenticate with valid GlobalProtect credentials and attack over the network; the required privileges are rated low. When the configuration condition applies, the attacker may bypass IP address limits and network access controls that rely on source IP filtering.

Exploitation status

Exploit Maturity is listed as UNREPORTED. Palo Alto Networks says it is not aware of malicious exploitation; this does not establish whether a public PoC exists or whether exploitation is impossible.

System checks

  1. Check the current PAN-OS version on the firewall and compare it with the fixed threshold for the corresponding branch. A version below that threshold needs an upgrade.

    show system info

  2. Check the firewall web interface for a configured GlobalProtect gateway. If a gateway is configured, the system meets the exposure condition described in the advisory.

    Network > GlobalProtect > Gateways

Remediation and mitigation

  1. Upgrade PAN-OS or Prisma Access to the corresponding fixed version for the branch in use.

  2. Prisma Access will be upgraded during its scheduled maintenance window. To request an earlier upgrade, contact Palo Alto Networks Support or the responsible team to arrange one.

  3. To reduce exposure, restrict access to the GlobalProtect service using DoS protection policy, country-based access restrictions, and an IP block list. These are mitigations; the source record does not provide a post-fix verification step.

References

References: Palo Alto PSIRT

Related articles