CVE-2026-0319: GlobalProtect gateway session impersonation by an authenticated user

What it is

The GlobalProtect gateway on PAN-OS mishandles some input. An attacker who already has a valid GlobalProtect login can use it to establish a session with another user’s identity. Palo Alto Networks classes it as improper input handling (CWE-754). The vendor found it internally; Ben Nott is credited.

The impact is impersonation, not a way in from the outside. The attacker needs valid credentials first. Once in, they get the network access and policy of the user they picked, which can be more than their own account allows, and VPN logs will show the wrong person.

Palo Alto Networks rates it medium and suggests moderate urgency. Exploit maturity is “unreported” and the vendor says it is not aware of malicious exploitation. This is a different flaw from the cookie forgery in CVE-2026-0257, which needs no credentials.

Am I affected?

The advisory says no special configuration is needed. If you run a GlobalProtect gateway on an affected version, you are exposed.

• PAN-OS 12.2 before 12.2.4.
• PAN-OS 12.1, 11.2, 11.1 and 10.2 on any build older than the fixed build for your maintenance release (see the table above).
• Prisma Access 12.1 before 12.1.7-h8, 11.2 before 11.2.7-h21, and 10.2 before 10.2.10-h41.
• End-of-life PAN-OS versions get no fix.

Not affected: Cloud NGFW and Panorama.

The advisory gives no menu path or command for checking exposure. Check your PAN-OS version against the table and confirm that a GlobalProtect gateway is configured.

What to do

1. Upgrade PAN-OS to the fixed build for your maintenance release, or to a newer one. On 12.2, go to 12.2.4 or later. On older branches, pick the newest fixed build you can (for example 11.2.16, 11.1.16-h3 or 10.2.18-h12). Plan this in your normal window; it is not an emergency, but internet-facing gateways with many users should go first.
2. Prisma Access: Palo Alto Networks upgrades tenants in the next scheduled maintenance cycle. Contact Support or your account team if you want an on-demand upgrade.
3. Unsupported versions: move to a supported, fixed release.
4. Workarounds: the advisory says none exist.
5. If you suspect abuse, review GlobalProtect logins for accounts that were not used by their owner, and reset credentials for any account involved. The vendor has not published guidance for this case.

Detection

Palo Alto Networks has published no indicators, detection rules or log signatures for this issue, and no one has reported exploitation. The advisory describes no specific log entries.

What you can do with your own logs:

• Compare GlobalProtect login records against who actually connected: the source IP, device and time should fit the user shown.
• Look for one source IP or device that logs in as several different users, or users who appear connected from two places at once.

These are general hunting ideas, not signs confirmed by a source.