What’s Vulnerable › Vulnerabilities

CVE-2026-0283: PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-09 · updated 2026-08-11
• Weakness: CWE-306

Description

An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Affected products

• Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4; from 11.1.8 before 11.1.10 — fixed in 10.2.10, 10.2.13, 10.2.16, 10.2.7, 11.1.10, 11.1.13

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.10, 10.2.13, 10.2.16, 10.2.7. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2026-0283
• https://cert-portal.siemens.com/productcert/html/ssa-104023.html

Get alerted when CVE-2026-0283 or the next vulnerability affects your stack