Plan ahead Medium Check your exposure CVSS 2.3 (NVD)
Palo Alto Networks GlobalProtect privilege escalation flaw in PAN-OS
Palo Alto Networks advisoriesPalo Alto Networks PAN-OS, GlobalProtectCVE-2026-0327
What happened. Palo Alto Networks published an advisory for CVE-2026-0327, a privilege escalation flaw in GlobalProtect on PAN-OS. The advisory rates it low severity.
Who is affected. Users of Palo Alto Networks PAN-OS with GlobalProtect. Industrial sites using this VPN for remote access are exposed, because vendors and engineers often reach plant systems through it.
What to do. Check whether you run GlobalProtect on PAN-OS and read the Palo Alto Networks advisory for CVE-2026-0327 for fixed versions.
When to act. Plan ahead: No exploitation stated; check whether you run GlobalProtect for vendor or engineer access and schedule the fix.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: GlobalProtect is a VPN gateway, a remote-access path that sits in the industrial DMZ (L3.5) or at the internet-facing edge (L5).
- Are you exposed?
Search your asset inventory for PAN-OS firewalls with GlobalProtect enabled, and check the advisory for affected versions.
- If you cannot fix it yet
- Limit who can connect through GlobalProtect to named users and require multi-factor authentication.
- Keep the gateway off the plant network and restrict its access to OT systems until patched.
- Watch for
- Unexpected privilege changes or new administrator activity on GlobalProtect accounts.
- Remote-access sessions that then reach L2 or L3 hosts from unusual accounts or at unusual times.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Palo Alto Networks advisories (opens security.paloaltonetworks.com)
More on Palo Alto Networks PAN-OS Palo Alto Networks CVE-2026-0327