A Panorama admin interface, a firewall dataplane and a VPN portal can share a software train and still need different exposure checks.
New November 11, 2026. Palo Alto Networks published these advisories on November 11.
Which exposure applies?
- CVE-2026-0330 affects Panorama. An authenticated administrator with network access can run code as root. Palo Alto rates internet-reachable management Medium, CVSS 4.0 6.1 threat-adjusted / 8.6 base, and jump-host-only management Medium 5.7 / 8.4.
- CVE-2026-0331 can expose firewall and session information to an unauthenticated party able to reach or send traffic through the dataplane on PA-Series and VM-Series. Palo Alto rates this Medium, 6.6 / 8.7. Prisma Access requires authentication and restricted external access, Medium 4.6 / 6.9. Cloud NGFW is affected and vendor-rated Low. Panorama is outside this disclosure’s scope.
- CVE-2026-0328 applies to a firewall GlobalProtect portal or gateway with third-party VPN clients enabled. An unauthenticated party can establish an unauthorized VPN connection. Vendor Low, 2.7 / 7.0. Palo Alto lists no known workaround. Check this setting first on internet-facing VPNs.
- CVE-2026-0329 can interrupt firewall service when an active certificate-based IKE gateway uses CRL or OCSP checking, or when DNS Proxy is enabled. Vendor Medium, 4.6 / 8.2. Prisma Access is in scope. Threat Prevention coverage is limited and requires the vendor’s inspection prerequisites. Preserve certificate revocation checking when planning the patch.
- CVE-2026-0325 can bypass source-IP rules for an authenticated GlobalProtect gateway user, Low 1.3 / 5.3. CVE-2026-0327 can elevate a lower-privileged GlobalProtect user when a gateway uses a supported RADIUS challenge, Low 2.3 / 6.0. For 0325, approved traffic restrictions can reduce exposure. For 0327, the vendor lists non-challenge authentication or client-certificate enforcement.
- CVE-2026-0326 can disrupt PAN-OS or Cloud NGFW service processing with SCTP, DNS Proxy or OSPFv3 on IPv6 configured as described by the vendor. Low 1.7 / 6.3. Check operational dependencies before applying the vendor’s configuration mitigations.
Scores above are CVSS 4.0 threat-adjusted / base. Palo Alto suggests Moderate urgency. Suggested MSP priority is expedited for internet-facing third-party VPN access, exposed Panorama management or untrusted access to the dataplane. Scope and stage other deployments according to their exposure.
Affected trains and fixed builds
For CVE-2026-0328 through CVE-2026-0331, the table pairs each vendor-listed affected train with its minimum fixed build. Affected releases in each train are below the corresponding build. Match the platform and the advisory to the deployed build before selecting the upgrade path.
| Branch | Vendor-listed affected trains | Corresponding minimum fixes |
|---|---|---|
| 12.2 | 12.2.0–12.2.4 hotfix train | 12.2.4-h2 |
| 12.1 | 12.1.2–12.1.4 / 12.1.5–12.1.7 / 12.1.8–12.1.10 trains | 12.1.4-h14 / 12.1.7-h12 / 12.1.10-h4 |
| 11.2 | 11.2.0–11.2.4 / 11.2.5–11.2.7 / 11.2.8–11.2.10 / 11.2.11–11.2.13 / 11.2.15–11.2.16 trains | 11.2.4-h24 / 11.2.7-h24 / 11.2.10-h18 / 11.2.13-h5 / 11.2.16-h2 |
| 11.1 | 11.1.0–11.1.4 / 11.1.5–11.1.6 / 11.1.7 / 11.1.8–11.1.10 / 11.1.11–11.1.13 / 11.1.14–11.1.16 trains | 11.1.4-h39 / 11.1.6-h41 / 11.1.7-h13 / 11.1.10-h37 / 11.1.13-h17 / 11.1.16-h5 |
| 10.2 | 10.2.0–10.2.7 / 10.2.8–10.2.10 / 10.2.11–10.2.13 / 10.2.14–10.2.16 / 10.2.17–10.2.18 trains | 10.2.7-h40 / 10.2.10-h43 / 10.2.13-h28 / 10.2.16-h13 / 10.2.18-h14 |
For 0325, 0326 and 0327, the fixed branch floors are 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 and 11.1.16-h5. The lower affected builds are 12.2.0, 11.2.0 and 11.1.0. The vendor starts 12.1 at 12.1.2 for 0325/0327 and at 12.1.0 for 0326. Move unsupported versions to a supported fixed release.
For 0329/0331, Prisma Access branch floors are 12.1.10-h4, 11.2.7-h24 and 10.2.10-h43, starting at 12.1.2, 11.2.0 and 10.2.0 respectively. For 0325/0327, Prisma Access 12.1 below 12.1.10-h4 and all 11.2 builds are listed as affected. The vendor directs 11.2 tenants to 12.1.10-h4 or later. Palo Alto lists all Cloud NGFW deployments as affected for 0326/0331 and manages those updates and Prisma Access updates on its maintenance cycle. Verify the tenant’s actual upgrade status.
What I’d check across customers
- Inventory model, role, exact build, HA pairing, management reachability and relevant VPN/dataplane settings.
- Restrict reachable Panorama management to a trusted internal jump host. For internet-facing VPNs with third-party clients enabled, review approved access restrictions while scheduling the fix. Exposure controls leave the vulnerable code in place. Palo Alto’s limited Panorama Threat Prevention coverage requires SSL decryption and content 9171-10349 or later, with Threat IDs 510045 and 510048.
- Apply the appropriate fixed build through the supported upgrade path. Coordinate managed-service maintenance with the vendor where applicable.
- Verify both HA peers and the manager build. Test device registration, policy pushes, representative VPN sign-ins, routing, IKE and DNS functions used by the customer.
Official sources CVE-2026-0325 · CVE-2026-0326 · CVE-2026-0327 · CVE-2026-0328 · CVE-2026-0329 · CVE-2026-0330 · CVE-2026-0331 · CISA KEV
Last verified November 11, 2026. The CVEs in this entry were absent from CISA’s KEV catalog at review. Palo Alto Networks reports no known malicious exploitation. The advisory guidance does not call for compromise checks or credential rotation.