PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
- Severity
- High7.1CVSS 3.1, High
- EPSS
- 0.41%
- Published
- 11 Sept 2024
- Updated
- 17 Jun 2026
Description
Title, description and vendor guidance are quoted from the source records.
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Weakness: CWE-497
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
0.41% probability of exploitation in the next 30 days (percentile 33%).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 11.0 | >= 11.0.0, < 11.0.1 | 11.0.1 |
| 10.2 | >= 10.2.0, < 10.2.4 | 10.2.4 |
| 10.1 | >= 10.1.0, < 10.1.9 | 10.1.9 |
| 10.0 | >= 10.0.0, < 10.0.12 | 10.0.12 |
| 9.1 | >= 9.1.0, < 9.1.16 | 9.1.16 |
| 9.0 | >= 9.0.0, < 9.0.17 | 9.0.17 |
| 8.1 | >= 8.1.0, < 8.1.25 | 8.1.25 |
Versions not listed are stated unaffected by the vendor.
Affected products
- Palo Alto Networks GlobalProtect App · 5.1.0 < 5.1.12, 5.2.0 < 5.2.13, 6.0.0 < 6.0.7, 6.1.0 < 6.1.2, 6.2.0 < 6.2.1
- Palo Alto Networks Prisma Access · 10.2.0 < 10.2.9 on PAN-OS
Workaround / Vendor remediation
Workaround · PAN-OS
Change the following two settings (if enabled) to "Allow with Ticket": * Network > GlobalProtect > Portals > > Agent > > App > Allow User to Disable GlobalProtect App * Network > GlobalProtect > Portals > > Agent > > App > Allow user to disconnect GlobalProtect App Change the following setting (if enabled) to "Disallow": * Network > GlobalProtect > Portals > > Agent > > App > Allow User to Uninstall GlobalProtect App
Vendor remediation · PAN-OS
This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions. It is also fixed in Prisma Access 10.2.9 and all later Prisma Access versions. To maintain GlobalProtect app functionality for the vulnerable features, we released a corresponding software update for GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.7, GlobalProtect app 6.1.2, and GlobalProtect app 6.2.1, and all later GlobalProtect app versions. To maintain the ability for end users to use the uninstall password feature and the disable or disconnect passcode feature, you must ensure that you upgrade all GlobalProtect app deployments to a fixed version before you upgrade your PAN-OS software to a fixed version. All fixed versions of GlobalProtect are backwards compatible with vulnerable versions of PAN-OS …
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC