EUVD-2026-42678
GHSA-jmqp-7m5h-wrr8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Network-reachable auth bypass with no privileges; scope changes because unauthorized VPN membership yields high confidentiality access to subsequent internal network systems.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
Authentication bypass in the Large Scale VPN (LSVPN) feature of Palo Alto Networks PAN-OS enables unauthenticated network-adjacent attackers to establish unauthorized site-to-site VPN connections without valid credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), where the LSVPN peer negotiation process fails to enforce authentication before allowing VPN tunnel establishment. While the CVSS 4.0 base score is 4.5, the subsequent-system confidentiality impact is rated High (SC:H), reflecting that a successful bypass grants the attacker routing-level access into networks protected by the VPN - a materially greater risk than the headline score suggests. No public exploit code exists and no active exploitation has been confirmed (CISA KEV not listed, E:U).
Technical ContextAI
PAN-OS is Palo Alto Networks' operating system for their Next-Generation Firewall (NGFW) appliances. Large Scale VPN (LSVPN) is a hub-and-spoke architecture within PAN-OS designed to simplify the deployment of thousands of site-to-site IPsec VPN tunnels, commonly used by enterprises with large branch-office footprints. CWE-306 (Missing Authentication for Critical Function) indicates the VPN peer establishment workflow fails to require or properly validate authentication before completing the tunnel setup handshake. This allows a network-positioned attacker to impersonate a legitimate VPN spoke, gaining a foothold inside the VPN overlay network. Notably, Panorama (the centralized management plane), Cloud NGFW (the cloud-native firewall service), and Prisma Access (the SSE/SASE platform) are explicitly excluded from the affected scope, narrowing impact to on-premises PAN-OS hardware and VM-series appliances with LSVPN configured. No CPE strings were provided in the input data, so exact affected software versions must be confirmed via the vendor advisory.
RemediationAI
The primary remediation is to apply the vendor-released patch once Palo Alto Networks publishes it via the advisory at https://security.paloaltonetworks.com/CVE-2026-0283 - no specific fixed PAN-OS version number was included in the available input data and one should not be assumed. Until a patch is applied, organizations should consider the following compensating controls: (1) Restrict network access to LSVPN hub interfaces using upstream ACLs or firewall rules, limiting which source IPs can initiate VPN peer negotiations - this reduces exposure to trusted network ranges only, at the cost of blocking legitimate remote spokes outside those ranges. (2) If LSVPN is not actively in use, disable the LSVPN feature on affected PAN-OS devices to eliminate the attack surface entirely. (3) Review LSVPN peer tables for any unrecognized or anomalous spoke entries, as unauthorized connections established prior to remediation would appear there. Subscribe to Palo Alto Networks Security Advisories (PSIRT) at the reference URL for patch release notifications.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today