Palo Alto PAN-OS LSVPN Authentication Bypass Vulnerability CVE-2026-0283 Advisory

Vulnerability Overview Vulnerability Name: CVE-2026-0283 PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) Vulnerability Description: An authentication bypass vulnerability exists in the Large Scale VPN (LSVPN) feature of Palo Alto Networks PAN-OS software, allowing attackers with network access to bypass security restrictions and establish unauthorized site-to-site VPN connections. Severity: Medium (CVSS-BT 4.5 / CVSS-B 7.8) Urgency: Medium Attack Vector: Network Attack Complexity: Low Attack Requirements: None User Interaction: None Privileges Required: None Product Confidentiality: High Product Integrity: Low Product Availability: Low Post-Confidentiality: High Post-Integrity: Low Post-Availability: None Automated Exploitation: No Value Density: Spreading Discovery Method: Internal Impact Scope Affected Products: - Cloud NGFW: None - PAN-OS 12.1: < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 - PAN-OS 11.2: < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13 - PAN-OS 11.1: < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 - PAN-OS 10.2: < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 - Prisma Access: None Affected Configuration: Applies only to firewalls using Large Scale VPN (LSVPN) with satellites configured. Remediation PAN-OS 12.1: - 12.1.5 to 12.1.7-h: Upgrade to 12.1.7-h2 or 12.1.8 or later. - 12.1.2 to 12.1.4-h: Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN-OS 11.2: - 11.2.11 to 11.2.12: Upgrade to 11.2.13 or later. - 11.2.8 to 11.2.10-h: Upgrade to 11.2.10-h12 or 11.2.13 or later. - 11.2.5 to 11.2.7-h: Upgrade to 11.2.7-h18 or 11.2.13 or later. - 11.2.0 to 11.2.4-h: Upgrade to 11.2.4-h20 or 11.2.13 or later. PAN-OS 11.1: - 11.1.14 to 11.1.15: Upgrade to 11.1.16 or later. - 11.1.11 to 11.1.13-h: Upgrade to 11.1.13-h9 or 11.1.16 or later. - 11.1.8 to 11.1.10-h: Upgrade to 11.1.10-h30 or 11.1.16 or later. - 11.1.7 to 11.1.7-h: Upgrade to 11.1.7-h8 or 11.1.16 or later. - 11.1.5 to 11.1.6-h: Upgrade to 11.1.6-h35 or 11.1.16 or later. - 11.1.0 to 11.1.4-h: Upgrade to 11.1.4-h35 or 11.1.16 or later. PAN-OS 10.2: - 10.2.17 to 10.2.18-h: Upgrade to 10.2.18-h8 or later. - 10.2.14 to 10.2.16-h: Upgrade to 10.2.16-h9 or later. - 10.2.11 to 10.2.13-h: Upgrade to 10.2.13-h23 or later. - 10.2.8 to 10.2.10-h: Upgrade to 10.2.10-h39 or later. - 10.2.0 to 10.2.7-h: Upgrade to 10.2.7-h36 or later. All other unsupported PAN-OS versions: Upgrade to a supported fixed version. Cloud NGFW and Prisma Access: No action required. Additional Information Workarounds and Mitigations: Threat Prevention subscription with limited coverage, enabling Threat ID 510032 (from Application and Threats Content version 9122-10145 and later). CPE Applicability: Specific CPE identifiers and their affected version ranges are listed. Timeline**: 2026-07-09 Initial release. POC Code or Exploit Code POC code or exploit code is not included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Palo Alto PAN-OS LSVPN Authentication Bypass Vulnerability CVE-2026-0283 Advisory