This vulnerability occurs when the PAN‑OS GlobalProtect gateway fails to correctly validate user input, allowing an authenticated user to establish a session that adopts the identity of another user. The attacker thereby gains the privileges of the impersonated account, potentially accessing sensitive data or executing actions with elevated permissions. The flaw is classified as CWE‑754, an information exposure issue caused by improper input validation.

Affected products are Palo Alto Networks PAN‑OS software and Prisma Access deployments running the GlobalProtect gateway. The vulnerability exists in PAN‑OS versions 12.2.0 through 12.2.3, 12.1.8 through 12.1.10‑h*, 12.1.5 through 12.1.7‑h*, 12.1.2 through 12.1.4‑h*, and their predecessor releases 11.2.5 through 11.2.7‑h*, 11.1.5 through 11.1.7‑h*, and 10.2.0 through 10.2.7‑h*. Upgraded releases such as 12.2.4 or later, 12.1.10‑h2 or later, 11.2.16 or later, 11.1.16‑h3 or later, or 10.2.18‑h12 or later contain the fix. Cloud NGFW is not affected.

The CVSS score of 4.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in KEV, suggesting no known public exploitation. However, the flaw requires authenticated access to the GlobalProtect gateway; an attacker who compromises an existing account can impersonate another user and gain unauthorized rights. The risk is driven by the potential for privilege escalation and data exposure, but current exploitation evidence is limited, keeping the immediate danger lower while still warranting prompt remediation.