I’M UNDER A CYBER ATTACK

Alert

Logo de Palo Alto Networks

Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma

Affected product(s): 

ProductAffected versions
PAN-OS (firewalls)12.2, 12.1, 11.2 and 11.1 earlier than the hotfixes in this batch; for CVE-2026-0331, 0330, 0329 and 0328 also 10.2. Advisories 0327, 0326 and 0325 do not list the 10.2 branch.
PanoramaAffected by CVE-2026-0330. Not affected by 0331, 0329, 0328 and 0327. Advisory 0325 does not mention it.
Cloud NGFWAffected by 0331 and 0326. Not affected by 0330, 0329, 0328, 0327 and 0325.
Prisma AccessAffected by 0331, 0329, 0327 and 0325. Not affected by 0330, 0328 and 0326.
GlobalProtect App on Windows6.3.0 through 6.3.3-h2 and 6.2.0 through 6.2.8-h3 (CVE-2026-0324). Does not affect macOS, Linux, iOS, Android or the UWP app.
Checkov by Prisma Cloud / Prisma BrowserCheckov: 2.0.1018 through 3.4.1 (CVE-2026-0323). Prisma Browser: versions earlier than the fixed builds in PAN-SA-2026-0014.

Fixed versions are not the same in every advisory; the detail by CVE is in the Solution section.

Description

Ten Palo Alto Networks security advisories have been published, released on Nov 11, 2026 at 2:00 p.m. (PYT), all at initial revision. None is rated critical. The main group affects PAN-OS; the same batch also includes advisories for GlobalProtect App on Windows, Checkov by Prisma Cloud, and the monthly Chromium update for Prisma Browser. The scores given are the vendor’s CVSS 4.0 ratings, using the published figure (CVSS-BT). The only high-severity advisory is the Chromium rollup in Prisma Browser, which is not a PAN-OS issue of its own.

AdvisoryCVSS 4.0ProductWhat it is
CVE-2026-03316.6, mediumPAN-OS (dataplane); also Cloud NGFW and Prisma AccessSensitive information disclosure, unauthenticated
CVE-2026-03306.1, mediumPAN-OS on Panorama onlyAuthenticated remote code execution, as root
CVE-2026-03294.6, mediumPAN-OS (dataplane); also Prisma AccessBuffer overflow / denial of service, with conditions
CVE-2026-03245.9, mediumGlobalProtect App on WindowsLocal escalation to SYSTEM via the OPSWAT SDK
PAN-SA-2026-00147.7, highPrisma BrowserMonthly Chromium update (November 2026)
CVE-2026-03282.7, lowPAN-OS (GlobalProtect portal and gateway)Authentication bypass; only if third-party VPN clients are allowed
CVE-2026-03272.3, lowPAN-OS (GlobalProtect gateway) and Prisma AccessPrivilege escalation; the advisory does not list 10.2
CVE-2026-03261.7, lowPAN-OS and Cloud NGFWBuffer overflow in protocol processing; the advisory does not list 10.2
CVE-2026-03251.3, lowPAN-OS (GlobalProtect gateway) and Prisma AccessAuthorization bypass; the advisory does not list 10.2 and does not mention Panorama
CVE-2026-03231.1, lowCheckov by Prisma CloudLocal SSRF, with a specific configuration

CVE-2026-0331, CVSS 4.0 6.6, medium, allows an unauthenticated remote attacker to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. No special configuration is required, and there are no known workarounds. Panorama is not affected. Cloud NGFW is (the vendor treats it as low severity on that product), and so is Prisma Access (on Prisma Access the published score is 4.6, medium). The vendor will update Prisma Access and Cloud NGFW in the next maintenance cycle; anyone who needs the update sooner can arrange a window with support or their account team.

CVE-2026-0330, CVSS 4.0 6.1, medium, allows an already authenticated administrator with network access to execute arbitrary code with root privileges on Panorama. It is not unauthenticated remote code execution, and it does not affect standalone PAN-OS firewalls, Cloud NGFW or Prisma Access. The base score (CVSS-B 8.6) is higher; it is not used here to raise the severity the vendor publishes. According to the vendor, the risk is significantly reduced if the management interface is limited to trusted internal addresses, following its recommended practices; that restriction is not an official workaround. The advisory states that no known workarounds exist. With a Threat Prevention subscription there is limited coverage by enabling Threat IDs 510045 and 510048 (Applications and Threats content 9171-10349 or later); those signatures require SSL decryption. The vendor recommends remediating as soon as possible if management is reachable from the Internet.

CVE-2026-0329, CVSS 4.0 4.6, medium, is a buffer overflow that allows an unauthenticated attacker to cause a denial of service on the dataplane, but only if one of these conditions is met: an active IKE Gateway uses certificate-based authentication with CRL or OCSP revocation checking enabled, or a DNS Proxy object is configured and enabled. Cloud NGFW and Panorama are not affected. Prisma Access is (the vendor treats it as low severity on that product) and will be updated in the next maintenance cycle. The issue can be mitigated by disabling those checks and DNS Proxy, and there is limited coverage with Threat IDs 510051 and 510052 (the same content 9171-10349 or later, with additional requirements and SSL decryption).

The same batch also fixes four low-severity issues in GlobalProtect and in protocol processing. CVE-2026-0328 (2.7, low) is an authentication bypass in the GlobalProtect portal and gateway that can allow an unauthorized VPN connection; it only affects those who enable third-party VPN clients, not those who use only the GlobalProtect client or Prisma Access Agent, and it shares the hotfix matrix of 0331, 0330 and 0329 (including 10.2). CVE-2026-0327 (2.3, low) allows an authenticated, lower-privileged user to obtain the privileges of a higher-privileged user when the gateway authentication profile uses RADIUS and issues a challenge. CVE-2026-0326 (1.7, low) can disrupt service processing if SCTP is enabled, a DNS Proxy is enabled, or OSPFv3 is enabled on an IPv6 interface; Cloud NGFW is affected. CVE-2026-0325 (1.3, low) allows an authenticated user with valid GlobalProtect credentials to bypass source-IP-based restrictions. Advisories 0327, 0326 and 0325 do not list PAN-OS 10.2; that is not the same as declaring that branch out of scope. In 0327 and 0325, Prisma Access 11.2 is affected in all versions, and the fix is to move to 12.1.10-h4 or later.

CVE-2026-0324, CVSS 4.0 5.9, medium, is a local escalation to NT AUTHORITY\SYSTEM in the OPSWAT MetaDefender SDK used by GlobalProtect App on Windows, for a locally authenticated Windows user without administrator privileges. There are no workarounds. It is fixed in GlobalProtect App 6.3.3-h3 (6.3.3-711) or 6.2.8-h4 (6.2.8-317), or later. CVE-2026-0323, CVSS 4.0 1.1, low, is an SSRF in Checkov by Prisma Cloud that applies only if external Terraform modules are downloaded and untrusted Terraform configurations are scanned; the Solution table lists 2.0.1018 through 3.4.1, fixed in 3.4.2 or later (the CPE block on the advisory page and the CVE record use different ranges; this bulletin follows the Solution table). PAN-SA-2026-0014 incorporates Chromium fixes into Prisma Browser, at CVSS 4.0 7.7, high; to cover the builds in the advisory’s Solution table, update to 157.19.4.39 or later. The advisory has range discrepancies among the product status, that table and the CPE.

The vendor reports no knowledge of malicious exploitation of these ten advisories and labels them with unreported exploit maturity. No public proof of concept was identified. As of Nov 11, 2026, these issues do not appear in catalogs of known exploited vulnerabilities. They are distinct from an earlier advisory from the same vendor, dated Oct 15, 2026 (CVE-2026-0322), which is not part of this batch. They are also distinct from the issues covered in Alert 2026-125 (Brotli and PHP2Shell, dated Oct 26, 2026): today’s hotfixes are the next increment (for example, 12.2.4-h2 versus 12.2.4-h1), and anyone who already applied those from that alert still needs these. On Nov 10, 2026 the vendor also published CVE-2026-0250, a separate GlobalProtect App advisory that is not part of these ten.

Mitigation

Inventory PAN-OS firewalls, Panorama, Prisma Access, Cloud NGFW, GlobalProtect clients on Windows, Checkov and Prisma Browser, record the exact branch and build, and apply the hotfix or version from the corresponding advisory: do not assume a single version number per family.

  • On Panorama (CVE-2026-0330): restrict management to trusted internal addresses or a jump box, as a vendor recommended practice — not as an official workaround — and, with a Threat Prevention subscription, enable Threat IDs 510045 and 510048 (content 9171-10349 or later, with SSL decryption).
  • For CVE-2026-0329, if the configuration applies: disable Use CRL and Use OCSP in the Certificate Profile of the active IKE Gateway, and disable DNS Proxy objects; then Commit. Signatures 510051 and 510052 provide limited coverage, with the additional requirements in the advisory and with SSL decryption.
  • For CVE-2026-0327: change the authentication profile to one without a challenge (for example, SAML), or require a client certificate, until you can update.
  • For CVE-2026-0326: remove the SCTP Protection profile from rules that allow SCTP; disable DNS Proxy; on OSPFv3, use cryptographic authentication other than ESP-NULL, as applicable.
  • For CVE-2026-0325: reduce Internet exposure of GlobalProtect (DoS policies, country restrictions and IP block lists), following the vendor’s guide. That does not replace the patch.
  • For CVE-2026-0328 there is no workaround: prioritize the patch if third-party VPN clients are allowed.
  • For CVE-2026-0331, CVE-2026-0324 and PAN-SA-2026-0014 there is no workaround: update.
  • For Checkov (CVE-2026-0323): do not scan untrusted content and avoid downloading external modules until you are on 3.4.2; pass configuration explicitly through a trusted file.
  • Prisma Access and Cloud NGFW, where affected: the vendor will apply the update in the next maintenance cycle; an earlier window can be requested.

These measures do not replace the update. The patch does not undo a prior compromise.

Detection

The vendor did not publish indicators of compromise.

Solution

The solution is to update each product to the fixed version of its branch, or later, according to the applicable advisory, prioritizing Panorama with exposed management (CVE-2026-0330), firewalls with a reachable dataplane (CVE-2026-0331 and, if the configuration applies, CVE-2026-0329) and GlobalProtect clients on Windows (CVE-2026-0324). Back up the configuration before updating PAN-OS, and follow the hotfix path for the branch and minor in use, without skipping an interval without checking the advisory table. Unsupported versions should be moved to a supported, already fixed branch.

PAN-OS — common matrix (CVE-2026-0331, 0330, 0329 and 0328)

These four share the same matrix. Do not apply it to CVE-2026-0327, 0326 or 0325.

BranchAffected (summary)Fix (choose by minor)
PAN-OS 12.2Earlier than 12.2.4-h212.2.4-h2 or later
PAN-OS 12.1Earlier than 12.1.4-h14, 12.1.7-h12 or 12.1.10-h412.1.10-h4 (12.1.8–12.1.10-h*); 12.1.7-h12 (12.1.5–12.1.7-h*); 12.1.4-h14 (12.1.2–12.1.4-h*)
PAN-OS 11.2Earlier than 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5 or 11.2.16-h211.2.16-h2 (11.2.15–11.2.16-h*); 11.2.13-h5 or 11.2.16-h2 (11.2.11–11.2.13-h*); 11.2.10-h18 or 11.2.16-h2 (11.2.8–11.2.10-h*); 11.2.7-h24 or 11.2.16-h2 (11.2.5–11.2.7-h*); 11.2.4-h24 or 11.2.16-h2 (11.2.0–11.2.4-h*)
PAN-OS 11.1Earlier than 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17 or 11.1.16-h511.1.16-h5 (11.1.14–11.1.16-h*); 11.1.13-h17 or 11.1.16-h5 (11.1.11–11.1.13-h*); 11.1.10-h37 or 11.1.16-h5 (11.1.8–11.1.10-h*); 11.1.7-h13 or 11.1.16-h5 (11.1.7–11.1.7-h*); 11.1.6-h41 or 11.1.16-h5 (11.1.5–11.1.6-h*); 11.1.4-h39 or 11.1.16-h5 (11.1.0–11.1.4-h*)
PAN-OS 10.2Earlier than 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13 or 10.2.18-h1410.2.18-h14 (10.2.17–10.2.18-h*); 10.2.16-h13 or 10.2.18-h14 (10.2.14–10.2.16-h*); 10.2.13-h28 or 10.2.18-h14 (10.2.11–10.2.13-h*); 10.2.10-h43 or 10.2.18-h14 (10.2.8–10.2.10-h*); 10.2.7-h40 or 10.2.18-h14 (10.2.0–10.2.7-h*)

PAN-OS — CVE-2026-0327, 0326 and 0325 (the advisory does not list 10.2)

ProductAffectedFixed in
PAN-OS 12.212.2.0 through 12.2.4-h*12.2.4-h2 or later
PAN-OS 12.10327 and 0325: 12.1.2 through 12.1.10-h*; 0326: 12.1.0 through 12.1.10-h*12.1.10-h4 or later
PAN-OS 11.211.2.0 through 11.2.16-h*11.2.16-h2 or later
PAN-OS 11.111.1.0 through 11.1.16-h*11.1.16-h5 or later
Prisma Access 12.1 (0327 and 0325)Earlier than 12.1.10-h412.1.10-h4 or later
Prisma Access 11.2 (0327 and 0325)All versionsMove to 12.1.10-h4 or later

GlobalProtect App, Checkov and Prisma Browser

ProductAffectedFixed in
GlobalProtect App 6.3 (Windows)6.3.0 through 6.3.3-h26.3.3-h3 (6.3.3-711) or later
GlobalProtect App 6.2 (Windows)6.2.0 through 6.2.8-h36.2.8-h4 (6.2.8-317) or later
Checkov by Prisma Cloud2.0.1018 through 3.4.13.4.2 or later
Prisma BrowserSee range discrepancies on the advisory157.19.4.39 or later

For information on how to update, visit the following link:

https://security.paloaltonetworks.com

Additional information: