{"id":12589,"date":"2026-11-11T12:45:21","date_gmt":"2026-11-11T18:45:21","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/"},"modified":"2026-11-11T12:48:19","modified_gmt":"2026-11-11T18:48:19","slug":"alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/","title":{"rendered":"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):&nbsp;<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Affected versions<\/strong><\/td><\/tr><tr><td><strong>PAN-OS (firewalls)<\/strong><\/td><td>12.2, 12.1, 11.2 and 11.1 earlier than the hotfixes in this batch; for CVE-2026-0331, 0330, 0329 and 0328 also 10.2. Advisories 0327, 0326 and 0325 do not list the 10.2 branch.<\/td><\/tr><tr><td><strong>Panorama<\/strong><\/td><td>Affected by CVE-2026-0330. Not affected by 0331, 0329, 0328 and 0327. Advisory 0325 does not mention it.<\/td><\/tr><tr><td><strong>Cloud NGFW<\/strong><\/td><td>Affected by 0331 and 0326. Not affected by 0330, 0329, 0328, 0327 and 0325.<\/td><\/tr><tr><td><strong>Prisma Access<\/strong><\/td><td>Affected by 0331, 0329, 0327 and 0325. Not affected by 0330, 0328 and 0326.<\/td><\/tr><tr><td><strong>GlobalProtect App on Windows<\/strong><\/td><td>6.3.0 through 6.3.3-h2 and 6.2.0 through 6.2.8-h3 (CVE-2026-0324). Does not affect macOS, Linux, iOS, Android or the UWP app.<\/td><\/tr><tr><td><strong>Checkov by Prisma Cloud \/ Prisma Browser<\/strong><\/td><td>Checkov: 2.0.1018 through 3.4.1 (CVE-2026-0323). Prisma Browser: versions earlier than the fixed builds in PAN-SA-2026-0014.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Fixed versions are not the same in every advisory; the detail by CVE is in the Solution section.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ten Palo Alto Networks security advisories have been published, released on Nov 11, 2026 at 2:00 p.m. (PYT), all at initial revision. None is rated critical. The main group affects PAN-OS; the same batch also includes advisories for GlobalProtect App on Windows, Checkov by Prisma Cloud, and the monthly Chromium update for Prisma Browser. The scores given are the vendor&#8217;s CVSS 4.0 ratings, using the published figure (CVSS-BT). The only high-severity advisory is the Chromium rollup in Prisma Browser, which is not a PAN-OS issue of its own.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Advisory<\/strong><\/td><td><strong>CVSS 4.0<\/strong><\/td><td><strong>Product<\/strong><\/td><td><strong>What it is<\/strong><\/td><\/tr><tr><td><strong>CVE-2026-0331<\/strong><\/td><td>6.6, medium<\/td><td>PAN-OS (dataplane); also Cloud NGFW and Prisma Access<\/td><td>Sensitive information disclosure, unauthenticated<\/td><\/tr><tr><td><strong>CVE-2026-0330<\/strong><\/td><td>6.1, medium<\/td><td>PAN-OS on Panorama only<\/td><td>Authenticated remote code execution, as root<\/td><\/tr><tr><td><strong>CVE-2026-0329<\/strong><\/td><td>4.6, medium<\/td><td>PAN-OS (dataplane); also Prisma Access<\/td><td>Buffer overflow \/ denial of service, with conditions<\/td><\/tr><tr><td><strong>CVE-2026-0324<\/strong><\/td><td>5.9, medium<\/td><td>GlobalProtect App on Windows<\/td><td>Local escalation to SYSTEM via the OPSWAT SDK<\/td><\/tr><tr><td><strong>PAN-SA-2026-0014<\/strong><\/td><td>7.7, high<\/td><td>Prisma Browser<\/td><td>Monthly Chromium update (November 2026)<\/td><\/tr><tr><td><strong>CVE-2026-0328<\/strong><\/td><td>2.7, low<\/td><td>PAN-OS (GlobalProtect portal and gateway)<\/td><td>Authentication bypass; only if third-party VPN clients are allowed<\/td><\/tr><tr><td><strong>CVE-2026-0327<\/strong><\/td><td>2.3, low<\/td><td>PAN-OS (GlobalProtect gateway) and Prisma Access<\/td><td>Privilege escalation; the advisory does not list 10.2<\/td><\/tr><tr><td><strong>CVE-2026-0326<\/strong><\/td><td>1.7, low<\/td><td>PAN-OS and Cloud NGFW<\/td><td>Buffer overflow in protocol processing; the advisory does not list 10.2<\/td><\/tr><tr><td><strong>CVE-2026-0325<\/strong><\/td><td>1.3, low<\/td><td>PAN-OS (GlobalProtect gateway) and Prisma Access<\/td><td>Authorization bypass; the advisory does not list 10.2 and does not mention Panorama<\/td><\/tr><tr><td><strong>CVE-2026-0323<\/strong><\/td><td>1.1, low<\/td><td>Checkov by Prisma Cloud<\/td><td>Local SSRF, with a specific configuration<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-0331, CVSS 4.0 6.6, medium, allows an unauthenticated remote attacker to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. No special configuration is required, and there are no known workarounds. Panorama is not affected. Cloud NGFW is (the vendor treats it as low severity on that product), and so is Prisma Access (on Prisma Access the published score is 4.6, medium). The vendor will update Prisma Access and Cloud NGFW in the next maintenance cycle; anyone who needs the update sooner can arrange a window with support or their account team.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-0330, CVSS 4.0 6.1, medium, allows an already authenticated administrator with network access to execute arbitrary code with root privileges on Panorama. It is not unauthenticated remote code execution, and it does not affect standalone PAN-OS firewalls, Cloud NGFW or Prisma Access. The base score (CVSS-B 8.6) is higher; it is not used here to raise the severity the vendor publishes. According to the vendor, the risk is significantly reduced if the management interface is limited to trusted internal addresses, following its recommended practices; that restriction is not an official workaround. The advisory states that no known workarounds exist. With a Threat Prevention subscription there is limited coverage by enabling Threat IDs 510045 and 510048 (Applications and Threats content 9171-10349 or later); those signatures require SSL decryption. The vendor recommends remediating as soon as possible if management is reachable from the Internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-0329, CVSS 4.0 4.6, medium, is a buffer overflow that allows an unauthenticated attacker to cause a denial of service on the dataplane, but only if one of these conditions is met: an active IKE Gateway uses certificate-based authentication with CRL or OCSP revocation checking enabled, or a DNS Proxy object is configured and enabled. Cloud NGFW and Panorama are not affected. Prisma Access is (the vendor treats it as low severity on that product) and will be updated in the next maintenance cycle. The issue can be mitigated by disabling those checks and DNS Proxy, and there is limited coverage with Threat IDs 510051 and 510052 (the same content 9171-10349 or later, with additional requirements and SSL decryption).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same batch also fixes four low-severity issues in GlobalProtect and in protocol processing. CVE-2026-0328 (2.7, low) is an authentication bypass in the GlobalProtect portal and gateway that can allow an unauthorized VPN connection; it only affects those who enable third-party VPN clients, not those who use only the GlobalProtect client or Prisma Access Agent, and it shares the hotfix matrix of 0331, 0330 and 0329 (including 10.2). CVE-2026-0327 (2.3, low) allows an authenticated, lower-privileged user to obtain the privileges of a higher-privileged user when the gateway authentication profile uses RADIUS and issues a challenge. CVE-2026-0326 (1.7, low) can disrupt service processing if SCTP is enabled, a DNS Proxy is enabled, or OSPFv3 is enabled on an IPv6 interface; Cloud NGFW is affected. CVE-2026-0325 (1.3, low) allows an authenticated user with valid GlobalProtect credentials to bypass source-IP-based restrictions. Advisories 0327, 0326 and 0325 do not list PAN-OS 10.2; that is not the same as declaring that branch out of scope. In 0327 and 0325, Prisma Access 11.2 is affected in all versions, and the fix is to move to 12.1.10-h4 or later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-0324, CVSS 4.0 5.9, medium, is a local escalation to NT AUTHORITY\\SYSTEM in the OPSWAT MetaDefender SDK used by GlobalProtect App on Windows, for a locally authenticated Windows user without administrator privileges. There are no workarounds. It is fixed in GlobalProtect App 6.3.3-h3 (6.3.3-711) or 6.2.8-h4 (6.2.8-317), or later. CVE-2026-0323, CVSS 4.0 1.1, low, is an SSRF in Checkov by Prisma Cloud that applies only if external Terraform modules are downloaded and untrusted Terraform configurations are scanned; the Solution table lists 2.0.1018 through 3.4.1, fixed in 3.4.2 or later (the CPE block on the advisory page and the CVE record use different ranges; this bulletin follows the Solution table). PAN-SA-2026-0014 incorporates Chromium fixes into Prisma Browser, at CVSS 4.0 7.7, high; to cover the builds in the advisory&#8217;s Solution table, update to 157.19.4.39 or later. The advisory has range discrepancies among the product status, that table and the CPE.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vendor reports no knowledge of malicious exploitation of these ten advisories and labels them with unreported exploit maturity. No public proof of concept was identified. As of Nov 11, 2026, these issues do not appear in catalogs of known exploited vulnerabilities. They are distinct from an earlier advisory from the same vendor, dated Oct 15, 2026 (CVE-2026-0322), which is not part of this batch. They are also distinct from the issues covered in Alert 2026-125 (Brotli and PHP2Shell, dated Oct 26, 2026): today&#8217;s hotfixes are the next increment (for example, 12.2.4-h2 versus 12.2.4-h1), and anyone who already applied those from that alert still needs these. On Nov 10, 2026 the vendor also published CVE-2026-0250, a separate GlobalProtect App advisory that is not part of these ten.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Inventory PAN-OS firewalls, Panorama, Prisma Access, Cloud NGFW, GlobalProtect clients on Windows, Checkov and Prisma Browser, record the exact branch and build, and apply the hotfix or version from the corresponding advisory: do not assume a single version number per family.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>On Panorama (CVE-2026-0330): restrict management to trusted internal addresses or a jump box, as a vendor recommended practice \u2014 not as an official workaround \u2014 and, with a Threat Prevention subscription, enable Threat IDs 510045 and 510048 (content 9171-10349 or later, with SSL decryption).<\/li>\n\n\n\n<li>For CVE-2026-0329, if the configuration applies: disable Use CRL and Use OCSP in the Certificate Profile of the active IKE Gateway, and disable DNS Proxy objects; then Commit. Signatures 510051 and 510052 provide limited coverage, with the additional requirements in the advisory and with SSL decryption.<\/li>\n\n\n\n<li>For CVE-2026-0327: change the authentication profile to one without a challenge (for example, SAML), or require a client certificate, until you can update.<\/li>\n\n\n\n<li>For CVE-2026-0326: remove the SCTP Protection profile from rules that allow SCTP; disable DNS Proxy; on OSPFv3, use cryptographic authentication other than ESP-NULL, as applicable.<\/li>\n\n\n\n<li>For CVE-2026-0325: reduce Internet exposure of GlobalProtect (DoS policies, country restrictions and IP block lists), following the vendor&#8217;s guide. That does not replace the patch.<\/li>\n\n\n\n<li>For CVE-2026-0328 there is no workaround: prioritize the patch if third-party VPN clients are allowed.<\/li>\n\n\n\n<li>For CVE-2026-0331, CVE-2026-0324 and PAN-SA-2026-0014 there is no workaround: update.<\/li>\n\n\n\n<li>For Checkov (CVE-2026-0323): do not scan untrusted content and avoid downloading external modules until you are on 3.4.2; pass configuration explicitly through a trusted file.<\/li>\n\n\n\n<li>Prisma Access and Cloud NGFW, where affected: the vendor will apply the update in the next maintenance cycle; an earlier window can be requested.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These measures do not replace the update. The patch does not undo a prior compromise.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Detection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vendor did not publish indicators of compromise.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The solution is to update each product to the fixed version of its branch, or later, according to the applicable advisory, prioritizing Panorama with exposed management (CVE-2026-0330), firewalls with a reachable dataplane (CVE-2026-0331 and, if the configuration applies, CVE-2026-0329) and GlobalProtect clients on Windows (CVE-2026-0324). Back up the configuration before updating PAN-OS, and follow the hotfix path for the branch and minor in use, without skipping an interval without checking the advisory table. Unsupported versions should be moved to a supported, already fixed branch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PAN-OS \u2014 common matrix (CVE-2026-0331, 0330, 0329 and 0328)<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These four share the same matrix. Do not apply it to CVE-2026-0327, 0326 or 0325.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Branch<\/strong><\/td><td><strong>Affected (summary)<\/strong><\/td><td><strong>Fix (choose by minor)<\/strong><\/td><\/tr><tr><td><strong>PAN-OS 12.2<\/strong><\/td><td>Earlier than 12.2.4-h2<\/td><td>12.2.4-h2 or later<\/td><\/tr><tr><td><strong>PAN-OS 12.1<\/strong><\/td><td>Earlier than 12.1.4-h14, 12.1.7-h12 or 12.1.10-h4<\/td><td>12.1.10-h4 (12.1.8\u201312.1.10-h*); 12.1.7-h12 (12.1.5\u201312.1.7-h*); 12.1.4-h14 (12.1.2\u201312.1.4-h*)<\/td><\/tr><tr><td><strong>PAN-OS 11.2<\/strong><\/td><td>Earlier than 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5 or 11.2.16-h2<\/td><td>11.2.16-h2 (11.2.15\u201311.2.16-h*); 11.2.13-h5 or 11.2.16-h2 (11.2.11\u201311.2.13-h*); 11.2.10-h18 or 11.2.16-h2 (11.2.8\u201311.2.10-h*); 11.2.7-h24 or 11.2.16-h2 (11.2.5\u201311.2.7-h*); 11.2.4-h24 or 11.2.16-h2 (11.2.0\u201311.2.4-h*)<\/td><\/tr><tr><td><strong>PAN-OS 11.1<\/strong><\/td><td>Earlier than 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17 or 11.1.16-h5<\/td><td>11.1.16-h5 (11.1.14\u201311.1.16-h*); 11.1.13-h17 or 11.1.16-h5 (11.1.11\u201311.1.13-h*); 11.1.10-h37 or 11.1.16-h5 (11.1.8\u201311.1.10-h*); 11.1.7-h13 or 11.1.16-h5 (11.1.7\u201311.1.7-h*); 11.1.6-h41 or 11.1.16-h5 (11.1.5\u201311.1.6-h*); 11.1.4-h39 or 11.1.16-h5 (11.1.0\u201311.1.4-h*)<\/td><\/tr><tr><td><strong>PAN-OS 10.2<\/strong><\/td><td>Earlier than 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13 or 10.2.18-h14<\/td><td>10.2.18-h14 (10.2.17\u201310.2.18-h*); 10.2.16-h13 or 10.2.18-h14 (10.2.14\u201310.2.16-h*); 10.2.13-h28 or 10.2.18-h14 (10.2.11\u201310.2.13-h*); 10.2.10-h43 or 10.2.18-h14 (10.2.8\u201310.2.10-h*); 10.2.7-h40 or 10.2.18-h14 (10.2.0\u201310.2.7-h*)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PAN-OS \u2014 CVE-2026-0327, 0326 and 0325 (the advisory does not list 10.2)<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Affected<\/strong><\/td><td><strong>Fixed in<\/strong><\/td><\/tr><tr><td><strong>PAN-OS 12.2<\/strong><\/td><td>12.2.0 through 12.2.4-h*<\/td><td>12.2.4-h2 or later<\/td><\/tr><tr><td><strong>PAN-OS 12.1<\/strong><\/td><td>0327 and 0325: 12.1.2 through 12.1.10-h*; 0326: 12.1.0 through 12.1.10-h*<\/td><td>12.1.10-h4 or later<\/td><\/tr><tr><td><strong>PAN-OS 11.2<\/strong><\/td><td>11.2.0 through 11.2.16-h*<\/td><td>11.2.16-h2 or later<\/td><\/tr><tr><td><strong>PAN-OS 11.1<\/strong><\/td><td>11.1.0 through 11.1.16-h*<\/td><td>11.1.16-h5 or later<\/td><\/tr><tr><td><strong>Prisma Access 12.1 (0327 and 0325)<\/strong><\/td><td>Earlier than 12.1.10-h4<\/td><td>12.1.10-h4 or later<\/td><\/tr><tr><td><strong>Prisma Access 11.2 (0327 and 0325)<\/strong><\/td><td>All versions<\/td><td>Move to 12.1.10-h4 or later<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>GlobalProtect App, Checkov and Prisma Browser<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Affected<\/strong><\/td><td><strong>Fixed in<\/strong><\/td><\/tr><tr><td><strong>GlobalProtect App 6.3 (Windows)<\/strong><\/td><td>6.3.0 through 6.3.3-h2<\/td><td>6.3.3-h3 (6.3.3-711) or later<\/td><\/tr><tr><td><strong>GlobalProtect App 6.2 (Windows)<\/strong><\/td><td>6.2.0 through 6.2.8-h3<\/td><td>6.2.8-h4 (6.2.8-317) or later<\/td><\/tr><tr><td><strong>Checkov by Prisma Cloud<\/strong><\/td><td>2.0.1018 through 3.4.1<\/td><td>3.4.2 or later<\/td><\/tr><tr><td><strong>Prisma Browser<\/strong><\/td><td>See range discrepancies on the advisory<\/td><td>157.19.4.39 or later<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For information on how to update, visit the following link:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/security.paloaltonetworks.com\">https:\/\/security.paloaltonetworks.com<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Additional information:&nbsp;<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Palo Alto Networks \u2014 security advisory index:<br><a href=\"https:\/\/security.paloaltonetworks.com\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0331:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0331\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0331<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0330:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0330\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0330<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0329:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0329\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0329<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0328:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0328\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0328<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0327:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0327\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0327<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0326:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0326\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0326<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0325:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0325\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0325<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0324:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0324\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0324<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 CVE-2026-0323:<br><a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0323\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/CVE-2026-0323<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 PAN-SA-2026-0014:<br><a href=\"https:\/\/security.paloaltonetworks.com\/PAN-SA-2026-0014\" target=\"_blank\" rel=\"noopener\">https:\/\/security.paloaltonetworks.com\/PAN-SA-2026-0014<\/a><\/li>\n\n\n\n<li>Palo Alto Networks \u2014 guide to limit GlobalProtect exposure:<br><a href=\"https:\/\/knowledgebase.paloaltonetworks.com\/KCSArticleDetail?id=kA14u0000008XtYCAU\" target=\"_blank\" rel=\"noopener\">https:\/\/knowledgebase.paloaltonetworks.com\/KCSArticleDetail?id=kA14u0000008XtYCAU<\/a><\/li>\n\n\n\n<li>Alert 2026-125 Critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell):<br><a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/\" target=\"_blank\" rel=\"noopener\">https:\/\/beaconlab.us\/en\/publication\/alert-2026-125-critical-vulnerabilities-in-palo-alto-pan-os-brotli-and-php2shell\/<\/a><\/li>\n<\/ul>\n\n","protected":false},"featured_media":12248,"template":"","class_list":["post-12589","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alert 2026-160: November updates for PAN-OS and Prisma\" \/>\n\t\t<meta property=\"og:description\" content=\"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-11T18:45:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-11T18:48:19+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alert 2026-160: November updates for PAN-OS and Prisma\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#listItem\",\"name\":\"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/\",\"name\":\"Alert 2026-160: November updates for PAN-OS and Prisma\",\"description\":\"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/paloalto-logo-destacada.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#mainImage\",\"width\":600,\"height\":600,\"caption\":\"Logo de Palo Alto Networks\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\\\/#mainImage\"},\"datePublished\":\"2026-11-11T12:45:21-06:00\",\"dateModified\":\"2026-11-11T12:48:19-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alert 2026-160: November updates for PAN-OS and Prisma","description":"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#listItem","name":"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#listItem","position":2,"name":"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/","name":"Alert 2026-160: November updates for PAN-OS and Prisma","description":"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/paloalto-logo-destacada.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#mainImage","width":600,"height":600,"caption":"Logo de Palo Alto Networks"},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/#mainImage"},"datePublished":"2026-11-11T12:45:21-06:00","dateModified":"2026-11-11T12:48:19-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alert 2026-160: November updates for PAN-OS and Prisma","og:description":"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png","article:published_time":"2026-11-11T18:45:21+00:00","article:modified_time":"2026-11-11T18:48:19+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alert 2026-160: November updates for PAN-OS and Prisma","twitter:description":"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12589","title":"Alert 2026-160: November updates for PAN-OS and Prisma","description":"Ten November advisories for PAN-OS, GlobalProtect, Prisma Access, Cloud NGFW and Prisma Browser. Update to the fixed version of each branch.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"custom_image","og_image_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png","og_image_width":"0","og_image_height":"0","og_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png","og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"custom_image","twitter_image_url":null,"twitter_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/11\/og-paloalto-2026-160-1200x630-1.png","twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-11-11 18:46:39","updated":"2026-11-11 21:15:59","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-160 November updates for PAN-OS, GlobalProtect and Prisma","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-160-november-updates-for-pan-os-globalprotect-and-prisma\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":2,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12589\/revisions"}],"predecessor-version":[{"id":12591,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12589\/revisions\/12591"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/12248"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}