# Palo Alto Networks Patches Dozens of Flaws

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/cca0d860-5460-56b8-a4d2-c725cb60c8bb/palo-alto-networks-patches-dozens-of-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory details numerous vulnerabilities across PAN-OS, GlobalProtect, Prisma Access/Browser and Checkov allowing RCE, privilege escalation and DoS; patches available.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1521

## What to check

- Applies to: The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has issued an advisory consolidating multiple vulnerabilities disclosed by Palo Alto Networks on 11 November 2026 affecting a broad range of products: PAN-OS (versions 10.2.x, 11.1.x, 11.2.x, 12.1.x and 12.2.x), GlobalProtect App for Windows (6.2.x and 6.3.x), Prisma Access (10.2.x, 11.2.x, 12.1.x), Prisma Access Browser, and Checkov by Prisma Cloud. The flaws collectively enable remote code execution, privilege escalation, remote denial of service, server-side request forgery (SSRF), security policy bypass, and loss of data confidentiality or integrity. No evidence of active exploitation is mentioned in the advisory; this is a coordinated patch release rather than a report of an ongoing attack.

Palo Alto Networks published nine dedicated security bulletins (CVE-2026-0323 through CVE-2026-0331) alongside a broader advisory (PAN-SA-2026-0014) referencing dozens of additional CVE identifiers covering the same product set. Given the volume of CVEs (over 60 referenced in total), defenders should prioritize patching internet-facing and VPN-exposed components — PAN-OS firewalls, GlobalProtect gateways/clients, and Prisma Access — as these are the most likely targets for exploitation of RCE and privilege escalation issues. Checkov and Prisma Access Browser should also be updated per vendor guidance.

Remediation is to upgrade to the fixed versions specified by Palo Alto Networks: PAN-OS 10.2.18-h14, 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2 or later; GlobalProtect App 6.2.8-h4 (6.2.8-317) and 6.3.3-h3 (6.3.3-711) for Windows; Prisma Access 10.2.10-h43 and 12.1.10-h4 or later; Prisma Access Browser 157.19.4.39 or later; and Checkov 3.4.2 or later. Defenders should consult the individual Palo Alto Networks security bulletins linked in the advisory for per-CVE severity scores and applicability to their deployed product versions.

## Mentioned in this report

- Vulnerabilities: CVE-2026-0323, CVE-2026-0324, CVE-2026-0325, CVE-2026-0326, CVE-2026-0327, CVE-2026-0328, CVE-2026-0329, CVE-2026-0330, CVE-2026-0331

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1521

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cca0d860-5460-56b8-a4d2-c725cb60c8bb/palo-alto-networks-patches-dozens-of-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup