{"id":"CVE-2026-0325","kind":"vulnerability","aliases":["CVE-2026-0325"],"related":[],"title":"PAN-OS GlobalProtect: authenticated users can bypass source IP access controls","description":"An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.\n\nCloud NGFW is not affected by this vulnerability.","summary":"An authorization bypass in the GlobalProtect gateway of PAN-OS lets an attacker with valid GlobalProtect credentials get past IP address restrictions and network access controls that rely on source IP filtering. Cloud NGFW is not affected.","severity":"low","cvss":1.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["globalprotect","infrastructure","palo-alto","pan-os","vpn"],"not_affected_if":["cloud-ngfw","no-globalprotect","no-source-ip-filtering"],"how_to_check":"- Check the PAN-OS version running on the firewall against the affected ranges in the Palo Alto Networks advisory\n- Review whether GlobalProtect gateway access rules rely on source IP filtering","fix":null,"status":"open","published_at":"2026-11-11T20:17:01+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:22+00:00","updated_at":"2026-11-11T20:30:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T20:30:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PAN-OS GlobalProtect: authenticated users can bypass source IP access controls","impact":"low","summary":"An authorization bypass in the GlobalProtect gateway of PAN-OS lets an attacker with valid GlobalProtect credentials get past IP address restrictions and network access controls that rely on source IP filtering. Cloud NGFW is not affected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["palo-alto","pan-os","globalprotect","vpn"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker bypasses IP-based network access controls behind the gateway","analyst_note":"Confirm affected PAN-OS version ranges and the fixed versions from the Palo Alto Networks security advisory for CVE-2026-0325.","how_to_check":"- Check the PAN-OS version running on the firewall against the affected ranges in the Palo Alto Networks advisory\n- Review whether GlobalProtect gateway access rules rely on source IP filtering\n- unknown for further steps, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cloud-ngfw","no-source-ip-filtering","no-globalprotect"],"who_is_affected":"Organizations running PAN-OS with a GlobalProtect gateway where network access decisions depend on the source IP of connecting users. The attacker must already hold valid GlobalProtect credentials. Cloud NGFW deployments are not affected, and deployments that do not use source IP filtering on GlobalProtect are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000764,"input_tokens":4578,"output_tokens":612,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-0325':15A,18A '-2026':14A,17A 'access':11A,53B,98C 'address':49B,93C 'affect':65B,110C 'alto':23B,76C 'attack':41B,85C 'authent':5A,84C 'author':29B,67C 'bypass':8A,30B,68C,91C 'circumv':96C 'cloud':61B,106C 'control':12A,54B,99C 'credenti':45B,89C 'cve':13A,16A 'enabl':82C 'filter':60B,105C 'gateway':34B,73C 'get':46B 'globalprotect':4A,19B,33B,44B,72C,88C 'infrastructur':20B 'ip':10A,48B,59B,92C,104C 'let':39B 'network':52B,77C,97C 'ngfw':62B,107C 'os':3A,26B,38B,80C 'palo':22B,75C 'palo-alto':21B 'pan':2A,25B,37B,79C 'pan-o':1A,24B,36B,78C 'past':47B 'reli':56B,101C 'restrict':50B,94C 'softwar':81C 'sourc':9A,58B,103C 'user':6A 'valid':43B,87C 'vpn':27B 'vulner':69C,113C","nicknames":[],"mitigations":[],"who_affected":"Organizations running PAN-OS with a GlobalProtect gateway where network access decisions depend on the source IP of connecting users. The attacker must already hold valid GlobalProtect credentials. Cloud NGFW deployments are not affected, and deployments that do not use source IP filtering on GlobalProtect are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["globalprotect","infrastructure","low","paloalto","panos","vpn"],"campaign_type":null,"search_a":"'-0325':15A,18A '-2026':14A,17A 'access':11A 'authent':5A 'bypass':8A 'control':12A 'cve':13A,16A 'globalprotect':4A 'ip':10A 'os':3A 'pan':2A 'pan-o':1A 'sourc':9A 'user':6A","search_b":"'access':53B 'address':49B 'affect':65B 'alto':23B 'attack':41B 'author':29B 'bypass':30B 'cloud':61B 'control':54B 'credenti':45B 'filter':60B 'gateway':34B 'get':46B 'globalprotect':19B,33B,44B 'infrastructur':20B 'ip':48B,59B 'let':39B 'network':52B 'ngfw':62B 'os':26B,38B 'palo':22B 'palo-alto':21B 'pan':25B,37B 'pan-o':24B,36B 'past':47B 'reli':56B 'restrict':50B 'sourc':58B 'valid':43B 'vpn':27B","search_c":"'access':98C 'address':93C 'affect':110C 'alto':76C 'attack':85C 'authent':84C 'author':67C 'bypass':68C,91C 'circumv':96C 'cloud':106C 'control':99C 'credenti':89C 'enabl':82C 'filter':105C 'gateway':73C 'globalprotect':72C,88C 'ip':92C,104C 'network':77C,97C 'ngfw':107C 'os':80C 'palo':75C 'pan':79C 'pan-o':78C 'reli':101C 'restrict':94C 'softwar':81C 'sourc':103C 'valid':87C 'vulner':69C,113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0325","severity":null,"published_at":"2026-11-11T20:17:01+00:00","modified_at":"2026-11-11T20:17:01+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}