Authentication bypass vulnerabilities in Palo Alto Networks GlobalProtect portal and gateway allow an attacker to bypass authentication requirements and establish an unauthorized VPN connection. The flaw removes the authentication barrier to the VPN, enabling the attacker to obtain a VPN session without proper credentials.

Affected systems include Palo Alto Networks PAN‑OS versions 12.1.5 through 12.1.6, 12.1.2 through 12.1.4‑h*, 11.2.11 or later, 11.1.14 or later, 10.2.17 or later, and similar ranges for older releases. Prisma Access versions 10.2.0 through 10.2.10‑h* and 11.2.0 through 11.2.7‑h* are also impacted. PAN‑OS Panorama and Cloud NGFW are not affected.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of 59% suggests a moderate probability of exploitation in the current threat landscape. The vulnerability is listed in the CISA KEV catalog, meaning it is known to be actively exploited. Likely attacks can be carried out remotely from any client or external system that can reach the GlobalProtect portal or gateway, enabling the attacker to establish a VPN session without authenticating.