---
id: "CVE-2026-0325"
page: "https://infrastack.ai/live/CVE-2026-0325"
kind: "vulnerability"
aliases: ["CVE-2026-0325"]
title: "PAN-OS GlobalProtect: authenticated users can bypass source IP access controls"
severity: "low"
cvss: 1.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["globalprotect", "infrastructure", "palo-alto", "pan-os", "vpn"]
not_affected_if: ["cloud-ngfw", "no-globalprotect", "no-source-ip-filtering"]
published_at: "2026-11-11T20:17:01+00:00"
first_seen_at: "2026-11-11T20:28:52+00:00"
updated_at: "2026-11-11T20:30:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0325", "first_seen_at": "2026-11-11T20:28:52+00:00"}]
exploit_sources: []
---

# PAN-OS GlobalProtect: authenticated users can bypass source IP access controls

Link for people: https://infrastack.ai/live/CVE-2026-0325 (this .md is for agents)

An authorization bypass in the GlobalProtect gateway of PAN-OS lets an attacker with valid GlobalProtect credentials get past IP address restrictions and network access controls that rely on source IP filtering. Cloud NGFW is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the PAN-OS version running on the firewall against the affected ranges in the Palo Alto Networks advisory
- Review whether GlobalProtect gateway access rules rely on source IP filtering

## Timeline

- 2026-11-11T20:28:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0325

## From the sources

An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering.

Cloud NGFW is not affected by this vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_