PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
- Severity
- High7.1CVSS 3.1, High
- Known exploited
- Not listed
- Exploit prediction
- 0.41%
- Published
- 11 Sept 2024Updated 17 Jun 2026 · Last verified 29 Sept 2026
Known remediation
Fixed releases per branch, as the vendor states them. Patcharo never infers a fix.
Palo Alto Networks PAN-OS
Vendor advisory- 11.011.0.1
- 10.210.2.4
- 10.110.1.9
- 10.010.0.12
- 9.19.1.16
- 9.09.0.17
- 8.18.1.25
Workaround / Vendor remediation
Workaround · PAN-OS
Change the following two settings (if enabled) to "Allow with Ticket": * Network > GlobalProtect > Portals > > Agent > > App > Allow User to Disable GlobalProtect App * Network > GlobalProtect > Portals > > Agent > > App > Allow user to disconnect GlobalProtect App Change the following setting (if enabled) to "Disallow": * Network > GlobalProtect > Portals > > Agent > > App > Allow User to Uninstall GlobalProtect App
Vendor remediation · PAN-OS
This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions. It is also fixed in Prisma Access 10.2.9 and all later Prisma Access versions. To maintain GlobalProtect app functionality for the vulnerable features, we released a corresponding software update for GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.7, GlobalProtect app 6.1.2, and GlobalProtect app 6.2.1, and all later GlobalProtect app versions. To maintain the ability for end users to use the uninstall password feature and the disable or disconnect passcode feature, you must ensure that you upgrade all GlobalProtect app deployments to a fixed version before you upgrade your PAN-OS software to a fixed version. All fixed versions of GlobalProtect are backwards compatible with vulnerable versions of PAN-OS …
Description
Title, description and vendor guidance are quoted from the source records.
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Weakness: CWE-497
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
0.41% probability of exploitation in the next 30 days (percentile 33%).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 11.0 | >= 11.0.0, < 11.0.1 | 11.0.1 |
| 10.2 | >= 10.2.0, < 10.2.4 | 10.2.4 |
| 10.1 | >= 10.1.0, < 10.1.9 | 10.1.9 |
| 10.0 | >= 10.0.0, < 10.0.12 | 10.0.12 |
| 9.1 | >= 9.1.0, < 9.1.16 | 9.1.16 |
| 9.0 | >= 9.0.0, < 9.0.17 | 9.0.17 |
| 8.1 | >= 8.1.0, < 8.1.25 | 8.1.25 |
Versions not listed are stated unaffected by the vendor.
Affected products
- Palo Alto Networks GlobalProtect App · 5.1.0 < 5.1.12, 5.2.0 < 5.2.13, 6.0.0 < 6.0.7, 6.1.0 < 6.1.2, 6.2.0 < 6.2.1
- Palo Alto Networks Prisma Access · 10.2.0 < 10.2.9 on PAN-OS
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 29 Sept 2026 at 03:17 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026 at 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 30 Sept 2026 at 00:17 UTC · Parser patcharo-epss/1.0.0
Last verified: 29 Sept 2026 at 03:17 UTC