Key points
- CVE-2026-0319 allows identity impersonation in GlobalProtect gateways.
- Fixes exist for PAN-OS 10.2, 11.1, and 11.2 branches.
- Cloud NGFW and Panorama are not affected by this vulnerability.
Palo Alto Networks has released updates to address CVE-2026-0319, a medium-severity improper input handling flaw in the GlobalProtect gateway component of its PAN-OS software. The vendor’s official advisory states that this vulnerability allows an authenticated user to establish a GlobalProtect session using the identity of another user. This means one legitimate user could potentially assume the digital persona of a different user within the same network environment.
In plain English
The core issue involves how the GlobalProtect gateway processes incoming data. According to the advisory, the system fails to properly check for unusual conditions during input handling. This oversight permits a user who has already logged in to manipulate session parameters. The result is that the gateway accepts the manipulated data and grants the user access under a different identity. No special configuration is required for a system to be vulnerable to this issue.
The background
Palo Alto Networks rates the severity of CVE-2026-0319 as medium. The base CVSS score is 7.6, while the temporal score is 4.9, reflecting the requirement for authentication. The vendor notes that it is not aware of any malicious exploitation of this issue in the wild. The flaw is categorized under CWE-754, which relates to improper checks for exceptional conditions. This classification highlights the failure to validate input boundaries correctly.
What changes now
Patches are now available for several PAN-OS version branches. Users running PAN-OS 10.2 should upgrade to version 10.2.7-h38 or later. For the 11.1 branch, upgrades to 11.1.4-h37 or newer are recommended. The 11.2 branch requires updates to 11.2.4-h22 or later. For PAN-OS 12.1, users must upgrade to 12.1.4-h12 or later. Updates for the 11.2.16 branch are expected by October 15.
Who needs to act first
Teams should prioritize updating systems that face the internet or handle sensitive user data. Start by identifying which gateways are exposed to external networks. Test the update in a non-production environment to ensure compatibility with existing configurations. Create a full backup of the current system state before applying any changes. Roll out the fix to a small subset of devices first to monitor for stability issues. Expand the deployment only after confirming no disruptions occur in the test group.
What to do and how to stay safe: Palo Alto Networks
- Inventory all PAN-OS devices to determine which versions are affected by CVE-2026-0319.
- Download and apply the recommended patches for your specific PAN-OS branch as soon as possible.
- Monitor GlobalProtect session logs for any unusual authentication patterns or identity mismatches.
- Contact Palo Alto Networks Support if you require an out-of-cycle upgrade for Prisma Access.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is Cloud NGFW affected by CVE-2026-0319?
No, according to the advisory, Cloud NGFW and Panorama are not affected by this vulnerability.
When will the fix for PAN-OS 11.2.16 be available?
The vendor states that an update for the 11.2.16 branch is expected by October 15.
Has this flaw been exploited in the wild?
Palo Alto Networks is not aware of any malicious exploitation of this issue currently.
