Authentication Bypass Vulnerability Affecting Palo Alto Networks GlobalProtect

GlobalProtect is a solution from Palo Alto Networks that provides secure corporate network access for remote users, through a portal and VPN gateway running PAN-OS software. This product is affected by a vulnerability labeled CVE-2026-0257 which results from bypassing authentication mechanisms. Exploiting this vulnerability would allow an unauthenticated attacker to bypass security restrictions and establish an unauthorized VPN connection. It is classified high with a severity score of 7.8 according to CVSS V3.1.

• PAN-OS 12.1: versions prior to 12.1.7, as well as version 12.1.4-h6;
• PAN-OS 11.2: versions prior to 11.2.12, as well as branches 11.2.10-h*, 11.2.7-h* and 11.2.4-h* prior to the respective patches;
• PAN-OS 11.1: versions prior to 11.1.15, as well as branches 11.1.13-h*, 11.1.10-h*, 11.1.7-h*, 11.1.6-h* and 11.1.4-h* prior to the respective patches;
• PAN-OS 10.2: versions prior to 10.2.18-h6, as well as branches 10.2.16-h*, 10.2.13-h*, 10.2.10-h* and 10.2.7-h* prior to the respective patches;
• Prisma Access 11.2: versions prior to 11.2.7-h13;
• Prisma Access 10.2: versions prior to 10.2.10-h36;