Palo Alto GlobalProtect input handling bug CVE-2026-0319 enables identity impersonation, patches released for PAN-OS

Palo Alto Networks has released patches for CVE-2026-0319, an improper input handling vulnerability in PAN-OS. The flaw allows authenticated users to bypass identity checks within the GlobalProtect gateway, enabling them to establish sessions under another user’s credentials.

What happened

The vulnerability exists in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. According to the official advisory, an authenticated user can exploit this improper input handling issue to initiate a GlobalProtect session using the identity of a different user. The vendor classifies the severity as medium with a moderate suggested urgency. Cloud NGFW and Panorama platforms are explicitly stated as not being affected by this specific issue.

Why it matters

This flaw impacts multiple PAN-OS version branches, including 10.2, 11.1, 11.2, and 12.1. Customers running versions below the specified patch thresholds are exposed to identity spoofing risks. Palo Alto Networks Prisma Access customers will receive upgrades during the next scheduled maintenance cycle, though on-demand windows are available for those requiring immediate remediation. No special configuration is required for the vulnerability to be present.

Next steps

• Upgrade PAN-OS to the latest patched versions listed in the advisory for your specific branch.
• Contact Palo Alto Networks Support if you require an immediate upgrade for Prisma Access outside the maintenance window.
• Verify that Cloud NGFW and Panorama instances are excluded from this specific remediation effort.
• Review GlobalProtect session logs for any anomalies in user identity assignments.

Detection notes

Teams should monitor GlobalProtect gateway logs for sessions where the authenticated user identity does not match the initiating credentials. Look for discrepancies between the login source and the assigned user profile in access records. Alert on multiple sessions originating from a single source IP but assigned to different user identities.

Check for unusual access patterns that deviate from standard user behaviour. Investigate any session establishment events that lack consistent identity metadata. Review firewall logs for unexpected privilege escalations or access to resources outside the user’s normal scope. Containment involves isolating affected gateway instances and forcing session termination for suspicious connections.

What to do and how to stay safe: Palo Alto Networks

• Audit current PAN-OS versions against the vendor’s patch list to identify exposed gateways.
• Monitor GlobalProtect logs for identity mismatches between authenticating users and session owners.
• Restrict GlobalProtect gateway access to trusted networks until patches are applied.
• Review user access rights to ensure least privilege principles are enforced in remote access policies.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PAN-OS versions are affected by CVE-2026-0319?

Versions below 10.2.7-h38, 11.1.4-h37, 11.2.4-h22, and 12.1.4-h12 are vulnerable, depending on the specific branch.

Is Cloud NGFW affected by this vulnerability?

No, Cloud NGFW and Panorama are not affected by this improper input handling vulnerability.

Has this flaw been exploited in the wild?

Palo Alto Networks states it is not aware of any malicious exploitation of this issue.