{"id":"CVE-2026-0327","kind":"vulnerability","aliases":["CVE-2026-0327"],"related":[],"title":"PAN-OS: GlobalProtect gateway flaw lets a low-privilege user gain admin rights","description":"A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user.\n\n\n\nCloud NGFW and Panorama are not affected by this vulnerability.","summary":"A privilege escalation flaw in the GlobalProtect gateway of PAN-OS lets an authenticated, lower-privileged user take on the privileges and configuration of a higher-privileged user. The attacker must already have a valid login on the gateway.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","globalprotect","infrastructure","pan-os","self-hosted"],"not_affected_if":["cloud-ngfw","globalprotect-disabled","panorama"],"how_to_check":"- Confirm the PAN-OS version running on the firewall and compare it with the fixed versions listed by the vendor (unknown in the sources provided).\n- Check whether GlobalProtect gateway is enabled on the device, since the flaw is in that component.\n- Cloud NGFW and Panorama are stated not to be affected.","fix":null,"status":"open","published_at":"2026-11-11T20:17:02+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:21+00:00","updated_at":"2026-11-11T20:30:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T20:30:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PAN-OS: GlobalProtect gateway flaw lets a low-privilege user gain admin rights","impact":"medium","summary":"A privilege escalation flaw in the GlobalProtect gateway of PAN-OS lets an authenticated, lower-privileged user take on the privileges and configuration of a higher-privileged user. The attacker must already have a valid login on the gateway.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["pan-os","globalprotect","firewall","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Lower-privileged user gains higher-privileged user's privileges and configuration","analyst_note":"Fixed PAN-OS versions and any mitigation are not in the sources; check the NVD entry and the vendor security advisory for CVE-2026-0327.","how_to_check":"- Confirm the PAN-OS version running on the firewall and compare it with the fixed versions listed by the vendor (unknown in the sources provided).\n- Check whether GlobalProtect gateway is enabled on the device, since the flaw is in that component.\n- Cloud NGFW and Panorama are stated not to be affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cloud-ngfw","panorama","globalprotect-disabled"],"who_is_affected":"Organizations running PAN-OS firewalls with the GlobalProtect gateway enabled and users who hold valid lower-privileged accounts on it. Cloud NGFW and Panorama are not affected according to the description. Teams without GlobalProtect gateway in use are likely not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000771,"input_tokens":4566,"output_tokens":628,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-0327':18A,21A '-2026':17A,20A 'admin':14A 'affect':114C 'alreadi':65B 'alto':83C 'attack':63B 'authent':45B,91C 'cloud':108C 'configur':55B,101C 'cve':16A,19A 'enabl':89C 'escal':33B,75C 'firewal':22B 'flaw':6A,34B 'gain':13A 'gateway':5A,38B,72B,80C 'globalprotect':4A,23B,37B,79C 'higher':59B,105C 'higher-privileg':58B,104C 'host':30B 'infrastructur':24B 'let':7A,43B 'login':69B 'low':10A 'low-privileg':9A 'lower':47B,93C 'lower-privileg':46B,92C 'must':64B 'network':84C 'ngfw':109C 'obtain':97C 'os':3A,27B,42B,87C 'palo':82C 'pan':2A,26B,41B,86C 'pan-o':1A,25B,40B,85C 'panorama':111C 'privileg':11A,32B,48B,53B,60B,74C,94C,99C,106C 'right':15A 'self':29B 'self-host':28B 'softwar':88C 'take':50B 'user':12A,49B,61B,95C,107C 'valid':68B 'vulner':76C,117C","nicknames":[],"mitigations":[],"who_affected":"Organizations running PAN-OS firewalls with the GlobalProtect gateway enabled and users who hold valid lower-privileged accounts on it. Cloud NGFW and Panorama are not affected according to the description. Teams without GlobalProtect gateway in use are likely not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","globalprotect","infrastructure","low","panos","selfhosted"],"campaign_type":null,"search_a":"'-0327':18A,21A '-2026':17A,20A 'admin':14A 'cve':16A,19A 'flaw':6A 'gain':13A 'gateway':5A 'globalprotect':4A 'let':7A 'low':10A 'low-privileg':9A 'os':3A 'pan':2A 'pan-o':1A 'privileg':11A 'right':15A 'user':12A","search_b":"'alreadi':65B 'attack':63B 'authent':45B 'configur':55B 'escal':33B 'firewal':22B 'flaw':34B 'gateway':38B,72B 'globalprotect':23B,37B 'higher':59B 'higher-privileg':58B 'host':30B 'infrastructur':24B 'let':43B 'login':69B 'lower':47B 'lower-privileg':46B 'must':64B 'os':27B,42B 'pan':26B,41B 'pan-o':25B,40B 'privileg':32B,48B,53B,60B 'self':29B 'self-host':28B 'take':50B 'user':49B,61B 'valid':68B","search_c":"'affect':114C 'alto':83C 'authent':91C 'cloud':108C 'configur':101C 'enabl':89C 'escal':75C 'gateway':80C 'globalprotect':79C 'higher':105C 'higher-privileg':104C 'lower':93C 'lower-privileg':92C 'network':84C 'ngfw':109C 'obtain':97C 'os':87C 'palo':82C 'pan':86C 'pan-o':85C 'panorama':111C 'privileg':74C,94C,99C,106C 'softwar':88C 'user':95C,107C 'vulner':76C,117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0327","severity":null,"published_at":"2026-11-11T20:17:02+00:00","modified_at":"2026-11-11T20:17:02+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}