OTPulse

PAN-OS: Improper Input Handling Vulnerability

Plan PatchCVSS 7.6CVE-2026-0319Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

An improper input handling vulnerability in the GlobalProtect gateway of PAN-OS enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected.

What this means
What could happen
An authenticated user can hijack another user's GlobalProtect remote access session, allowing them to access network resources and systems using a compromised identity. This could enable lateral movement within your network and unauthorized access to sensitive infrastructure.
Who's at risk
Organizations using Palo Alto Networks PAN-OS or Prisma Access for remote workforce access (GlobalProtect). This affects utilities and critical infrastructure operators who rely on these firewalls for VPN access by field technicians, remote administration staff, and engineers connecting to SCADA systems or industrial networks.
How it could be exploited
An attacker with valid credentials to your GlobalProtect gateway can craft a specially-formed authentication request that causes the gateway to establish a session under a different user's identity. The attacker then uses this hijacked session to access internal resources that the impersonated user has access to.
Prerequisites
  • Valid GlobalProtect user credentials (attacker's own account)
  • Network access to GlobalProtect gateway
  • Knowledge of target user's identity
Remotely exploitableAuthentication required (but attacker uses own credentials)Identity spoofing riskCould enable lateral movement to OT networks
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.412.2.4+
Prisma AccessBelow 12.1.4-h1212.1.4-h12+
Prisma AccessBelow 12.1.7-h812.1.7-h8+
Prisma AccessBelow 12.1.10-h212.1.10-h2+
Remediation & Mitigation
0/6
Do now
0/1
HARDENINGReview GlobalProtect access logs for suspicious session activity or sessions established by users from unexpected locations or times
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.4-h12 or later (for 12.1.4 branch)
HOTFIXUpdate Prisma Access to version 12.1.7-h8 or later (for 12.1.7 branch)
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later (for 12.1.10 branch)
Long-term hardening
0/1
HARDENINGRestrict GlobalProtect gateway access to known trusted networks or IP ranges where remote workers typically connect from
View full vendor advisory
API: /api/v1/advisories/2ca1f325-c1b1-45d1-b3f2-4c832d76975d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

PAN-OS: Improper Input Handling Vulnerability | CVSS 7.6 - OTPulse