Vulnerability record/PUBLISHED/Published Nov 11, 2026 19:45:53 UTC

CVE-2026-0328

Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.

Base score2.7/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsPresentAT

Privileges requiredNonePR

User interactionNoneUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityHighSC

Subsequent system integrityHighSI

Subsequent system availabilityNoneSA

Exploit maturityUnprovenE

AutomatableNoAU

RecoveryUserR

Value densityDiffuseV

Response effortModerateRE

Provider urgencyAmberU

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritypalo_alto

Last updatedNov 13, 2026 19:36:35 UTC

PublishedNov 11, 2026 19:45:53 UTC

ReservedNov 3, 2025 20:46:30 UTC

Credits

OpenAI
Rotem Bar (internal reporter)