CVE-2026-0319: Patches Available for PAN-OS GlobalProtect Session Impersonation Flaw

Palo Alto Networks has issued fixes for a vulnerability in its PAN-OS software that allows authenticated users to impersonate other users within the GlobalProtect gateway.

The risk

According to the Palo Alto Networks PSIRT advisory, CVE-2026-0319 is an improper input handling vulnerability. It enables an authenticated user to establish a GlobalProtect session using the identity of another user. The vendor rates the severity as medium. The CVSS base score is 7.6, while the CVSS base score for threats with privileges is 4.9. Palo Alto Networks states it is not aware of any malicious exploitation of this issue. No special configuration is required for a system to be affected by this flaw.

Who is exposed

The vulnerability affects specific versions of PAN-OS running the GlobalProtect gateway. Affected versions include those prior to 11.2.16, 11.1.16-h3, and 10.2.18-h12, along with numerous intermediate releases in the 11.2, 11.1, and 10.2 series. Cloud NGFW and Panorama are explicitly stated as not affected by this vulnerability. Customers using Palo Alto Networks Prisma Access will receive upgrades during the next scheduled maintenance cycle. Those requiring earlier upgrades should contact support or account teams.

Cost and compliance

The source material does not provide specific data regarding financial costs or regulatory compliance impacts associated with this vulnerability.

What should you do?

Administrators should verify their current PAN-OS version against the affected list provided by Palo Alto Networks. If running a vulnerable version, plan an upgrade to the recommended patched release. Monitor system logs for any unusual session establishment patterns that might indicate identity spoofing attempts.

The background in plain language

Identity verification ensures that the person accessing a system is who they claim to be. When software fails to properly handle input, it may accept false identity data. This allows an attacker to masquerade as a legitimate user. Teams usually review access logs to detect discrepancies between user actions and assigned identities. Checking whether session initiation matches expected user behavior helps identify potential impersonation events before they cause broader issues.

What to do and how to stay safe: Palo Alto Networks

• Audit current PAN-OS versions to determine if they fall within the affected ranges listed in the advisory.
• Schedule upgrades to the specified patched versions, prioritizing systems with high user concurrency.
• Review GlobalProtect session logs for anomalies where session attributes do not match the authenticating user.
• Contact Palo Alto Networks support if immediate upgrades are not feasible to discuss temporary mitigation options.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is Cloud NGFW affected by CVE-2026-0319?

No, the advisory states that Cloud NGFW and Panorama are not affected by this vulnerability.

Has this vulnerability been exploited in the wild?

Palo Alto Networks reports it is not aware of any malicious exploitation of this issue.

What is the CVSS score for this vulnerability?

The CVSS base score is 7.6, and the CVSS base score for threats with privileges is 4.9.