CVE-2026-0283: PAN-OS Authentication Bypass in Large Scale VPN

Technical summary

CVE-2026-0283 is an authentication bypass vulnerability stemming from improper authentication enforcement (CWE-306) in PAN-OS LSVPN functionality. An unauthenticated attacker positioned on the network can exploit missing or insufficient authentication checks to establish VPN tunnels to protected sites. The CVSS 3.1 score of 7.2 (HIGH) reflects network-accessible attack vector, low complexity, no privileges required, and cross-boundary impact with confidentiality and integrity consequences. The attack requires no user interaction, making it immediately actionable by a capable adversary.

Business impact

Successful exploitation enables attackers to bypass your organization's VPN authentication controls and access site-to-site connections intended only for trusted partners or remote offices. This can lead to unauthorized network access, lateral movement within connected infrastructure, data exfiltration from interconnected sites, and potential compromise of business-critical systems spanning multiple locations. Organizations relying on PAN-OS firewalls for site-to-site VPN security face material risk of insider-equivalent access without detection by standard perimeter controls.

Affected systems

PAN-OS across multiple versions is vulnerable. Panorama management appliances, Cloud NGFW deployments, and Prisma Access services are explicitly not affected, reducing scope for some hybrid and cloud-native environments. Organizations should verify their specific PAN-OS versions and deployment models against the official Palo Alto Networks security advisory to determine exposure.

Exploitability

This vulnerability is practically exploitable with low barriers to entry. It requires only network access to the affected PAN-OS device and no authentication credentials, privilege escalation, or social engineering. An attacker on the same network segment or with routing access to the firewall can attempt exploitation. The lack of known public exploit activity (not currently on CISA's KEV catalog) does not diminish the technical exploitability—the straightforward authentication bypass mechanism makes weaponization a routine matter for capable threat actors.

Remediation

Apply the official Palo Alto Networks security patch for your PAN-OS version as outlined in the vendor advisory. Verify against the official advisory for specific patched versions. As an interim control, restrict network access to VPN management interfaces through segmentation, access control lists, or additional firewall rules limiting VPN connection attempts to known, legitimate peer addresses. Disable LSVPN functionality if not actively used in your environment.

Patch guidance

Consult the official Palo Alto Networks security advisory (PSA) for CVE-2026-0283 to identify the patched versions applicable to your PAN-OS deployment. Patches are typically released across multiple version branches; verify the correct patch for your active PAN-OS version before applying. Test patches in a non-production environment first, as PAN-OS updates may require coordination with redundant firewall pairs and VPN peer notification. Plan for maintenance windows to minimize service interruption during deployment.

Detection guidance

Monitor firewall logs for anomalous VPN connection attempts originating from unexpected sources or using invalid credentials. Look for site-to-site VPN establishment events that deviate from normal peer communication patterns, failed authentication attempts followed by successful connection states, and unusual LSVPN traffic flows. Implement network segmentation to isolate VPN tunnel endpoints and alert on unexpected inter-site communication. Log and inspect VPN handshake failures and successful establishments for correlation with known threat activity.

Why prioritize this

HIGH priority. The vulnerability combines network accessibility, no authentication requirement, straightforward exploitation path, and direct impact on core network security infrastructure. Site-to-site VPN compromise can serve as a beachhead for lateral movement and persistent access across your network perimeter. The CVSS 7.2 score and broad PAN-OS version exposure justify immediate patching within standard critical/high vulnerability SLAs, particularly for organizations with multi-site architectures relying on these tunnels.

Risk score, explained

The CVSS 3.1 base score of 7.2 reflects a network-exploitable authentication bypass with cross-boundary scope impact. The vector AV:N/AC:L/PR:N/UI:N indicates any network-adjacent attacker can exploit without setup complexity or user action. S:C (Scope Changed) elevates severity because successful exploitation affects not just the firewall but the confidentiality and integrity of connected sites. The absence of availability impact prevents a critical rating, but the straightforward path to unauthorized network access justifies the HIGH designation in most risk contexts.

Frequently asked questions