Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. This vulnerability enables attackers to bypass security restrictions and establish unauthorized VPN connections. The issue affects PAN-OS versions 10.2, 11.1, 11.2, and 12.1, with specific subversion vulnerabilities. Notably, Panorama and Cloud NGFW are not impacted.

Impact

Exploitation of this vulnerability allows for unauthorized VPN connections, bypassing established security measures.

Remediation

Users can upgrade to the latest versions of PAN-OS 10.2, 11.1, 11.2, or 12.1. For those using Prisma Access, upgrades are being managed according to a set schedule. After upgrading, GlobalProtect users will need to re-authenticate, as the authentication override cookie will be regenerated using a more secure method.