Authentication bypass vulnerabilities in Palo Alto Networks GlobalProtect portal and gateway let an attacker create an unauthorized VPN session without meeting authentication requirements, compromising network confidentiality for users relying on the VPN. The flaw is classified as CWE‑565 (Use of Insecure or Untrusted Control Flow) and does not provide remote code execution, privilege escalation, or direct access to the protected network itself; it merely removes the authentication barrier for the VPN connection.

Affected systems are Palo Alto Networks PAN‑OS versions 12.1.5‑12.1.6, 12.1.2‑12.1.4‑h*, 11.2.11 or later, 11.1.14 or later, 10.2.17 or later, and equivalent ranges for older releases. Prisma Access versions 10.2.0‑10.2.10‑h* and 11.2.0‑11.2.7‑h* are also affected. PAN-OS Panorama and Cloud NGFW are not impacted.

The CVSS score is 7.8, indicating a high severity vulnerability, while the EPSS score of 48% suggests a moderate probability of exploitation in the current threat landscape. The vulnerability is listed in the CISA KEV catalog. Likely attack can occur remotely from a client or an external system that can reach the GlobalProtect portal or gateway, bypassing authentication controls without any local privileges. The attacker need not compromise the device beforehand, making this a straightforward network-based attack for customers who rely on GlobalProtect for secure access.