CVE-2026-0328

LowCVSS 2.7/10Last modified Nov 11, 2026

Description

Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection.

Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.

Metrics

CVSS 4.0 2.7/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-03294.6A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a de CVE-2026-03306.1A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with n CVE-2026-03316.6An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network acces CVE-2026-03837.8A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecur CVE-2026-03855.0Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability CVE-2026-03867.5Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-03906.7Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locall CVE-2026-03916.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoof CVE-2026-03927.3eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or CVE-2026-03936.5The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to in CVE-2026-03945.3When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added CVE-2026-03964.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where