CVE-2026-0283: 
PAN-OS vulnerability analysis and mitigation

CVE-2026-0283 is an authentication bypass vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS software. It allows an unauthenticated attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Affected versions span PAN-OS 10.2.x (before 10.2.18-h8), 11.1.x (before 11.1.16), 11.2.x (before 11.2.13), and 12.1.x (before 12.1.8). Panorama, Cloud NGFW, and Prisma® Access are not affected. The vulnerability was disclosed on July 8, 2026, and carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 4.5 (Medium) (Palo Alto Advisory, GitHub Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), meaning the LSVPN component fails to enforce authentication for a critical operation — establishing a site-to-site VPN connection. An attacker with network-level access to the GlobalProtect portal interface can send crafted requests to the LSVPN satellite registration endpoint without providing valid credentials, bypassing the authentication gate entirely. The vulnerability is only exploitable on firewalls that have LSVPN configured with satellites; deployments without satellite configuration are not exposed. No public proof-of-concept code has been reported (Palo Alto Advisory).

Successful exploitation allows an unauthenticated attacker to establish an unauthorized site-to-site VPN tunnel into the target network, potentially gaining access to protected internal resources reachable via that VPN. The subsequent system confidentiality impact is rated High, indicating that resources beyond the directly vulnerable firewall — such as internal network segments — may be exposed. While availability is not directly impacted, the integrity and confidentiality of network traffic and connected systems are at risk, and the unauthorized VPN connection could serve as a foothold for lateral movement (Palo Alto Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Palo Alto Networks firewalls running PAN-OS with LSVPN (GlobalProtect with satellite configuration) using tools like Shodan or Censys, targeting the GlobalProtect portal interface.
2. Confirm LSVPN exposure: Probe the target for GlobalProtect portal endpoints associated with satellite VPN registration to confirm LSVPN is active and reachable.
3. Craft unauthenticated VPN request: Send a crafted site-to-site VPN connection request to the LSVPN satellite registration endpoint, omitting or bypassing the expected authentication parameters that the vulnerable code path fails to enforce.
4. Establish unauthorized tunnel: Due to the missing authentication check (CWE-306), the firewall accepts the connection request and establishes an unauthorized site-to-site VPN tunnel with the attacker-controlled endpoint.
5. Access internal resources: Use the established VPN tunnel to access internal network resources reachable through the VPN, enabling reconnaissance, data exfiltration, or lateral movement within the target network (Palo Alto Advisory).

• Network: Unexpected or unrecognized satellite VPN connection attempts or established tunnels visible in GlobalProtect portal logs; inbound VPN negotiation traffic from unknown or unauthorized IP addresses targeting the GlobalProtect portal.
• Logs: PAN-OS system logs showing new satellite VPN connections from unrecognized endpoints; GlobalProtect gateway logs indicating satellite registration events without corresponding authorized satellite records.
• Configuration: Presence of unauthorized satellite entries in the running configuration (show config running | match satellite returning unexpected results); new or unrecognized VPN peer entries in the GlobalProtect portal satellite tab.
• Traffic: Unusual internal network traffic originating from VPN tunnel interfaces associated with unrecognized satellite peers; unexpected data flows traversing site-to-site VPN tunnels to unknown external IP addresses (Palo Alto Advisory).

Palo Alto Networks has released patched versions across all affected branches. Organizations should upgrade to the following minimum fixed versions: PAN-OS 10.2.x → 10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, or 10.2.18-h8; PAN-OS 11.1.x → 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, or 11.1.16; PAN-OS 11.2.x → 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, or 11.2.13; PAN-OS 12.1.x → 12.1.4-h8, 12.1.7-h2, or 12.1.8. As a temporary mitigation, customers with a Threat Prevention subscription can enable Threat ID 510032 (available from Applications and Threats content version 9122-10145 and later) with a vulnerability protection profile applied to the GlobalProtect interface, though this provides only limited coverage. The vulnerability only affects firewalls with LSVPN satellites configured; organizations can verify exposure via the CLI command show config running | match satellite (Palo Alto Advisory).

The vulnerability was discovered internally by Palo Alto Networks researcher Vaibhav Nagar and the internal security research team, and was disclosed on July 8, 2026. The HKCERT published a security bulletin covering this and other Palo Alto vulnerabilities disclosed in the same advisory cycle. The Italian CERT (GARR) also issued an alert referencing the vulnerability. Community aggregators including VulnDB, CVEFeed, and Vulners indexed the advisory shortly after publication. No significant independent researcher commentary or social media controversy has been observed, consistent with the moderate severity rating and absence of active exploitation (Palo Alto Advisory).