This issue is applicable only to firewalls using Large Scale VPN (LSVPN) with configured satellites.
To check if your firewall has LSVPN satellites configured, run the following from the PAN-OS CLI:
If output is returned, LSVPN is in use.
You can also verify in the web interface by navigating to Network > GlobalProtect > Portals, selecting each portal, and checking whether the Satellite tab contains any configured satellites.
"}]}],"workarounds":[{"lang":"eng","value":"Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability when enabling Threat ID 510032 (from Applications and Threats content version 9122-10145 and later). \n\nTo ensure the Threat ID provides effective protection against this vulnerability, ensure that vulnerability protection security profile is applied to your GlobalProtect interface https://live.paloaltonetworks.com/t5/globalprotect-articles/applying-vulnerability-protection-to-globalprotect-interfaces/ta-p/340184 .","supportingMedia":[{"type":"text/html","base64":false,"value":"Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability when enabling Threat ID 510032 (from Applications and Threats content version 9122-10145 and later).
To ensure the Threat ID provides effective protection against this vulnerability, ensure that vulnerability protection security profile is applied to your GlobalProtect interface.
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW All | No action needed. | |
| PAN-OS 12.1 | \n 12.1.5 through 12.1.7-h* | \nUpgrade to 12.1.7-h2 or 12.1.8 or later. | \n
| \n | 12.1.2 through 12.1.4-h* | \nUpgrade to 12.1.4-h8 or 12.1.8 or later. | \n
| PAN-OS 11.2 | \n 11.2.11 through 11.2.12 | \nUpgrade to 11.2.13 or later. | \n
| \n | 11.2.8 through 11.2.10-h* | \nUpgrade to 11.2.10-h12 or 11.2.13 or later. | \n
| \n | 11.2.5 through 11.2.7-h* | \nUpgrade to 11.2.7-h18 or 11.2.13 or later. | \n
| \n | 11.2.0 through 11.2.4-h* | \nUpgrade to 11.2.4-h20 or 11.2.13 or later. | \n
| PAN-OS 11.1 | \n 11.1.14 through 11.1.15 | \nUpgrade to 11.1.16 or later. | \n
| \n | 11.1.11 through 11.1.13-h* | \nUpgrade to 11.1.13-h9 or 11.1.16 or later. | \n
| \n | 11.1.8 through 11.1.10-h* | \nUpgrade to 11.1.10-h30 or 11.1.16 or later. | \n
| \n | 11.1.7 through 11.1.7-h* | \nUpgrade to 11.1.7-h8 or 11.1.16 or later. | \n
| \n | 11.1.5 through 11.1.6-h* | \nUpgrade to 11.1.6-h35 or 11.1.16 or later. | \n
| \n | 11.1.0 through 11.1.4-h* | \nUpgrade to 11.1.4-h35 or 11.1.16 or later. | \n
| PAN-OS 10.2 | \n 10.2.17 through 10.2.18-h* | \nUpgrade to 10.2.18-h8 or later. | \n
| \n | 10.2.14 through 10.2.16-h* | \nUpgrade to 10.2.16-h9 or later. | \n
| \n | 10.2.11 through 10.2.13-h* | \nUpgrade to 10.2.13-h23 or later. | \n
| \n | 10.2.8 through 10.2.10-h* | \nUpgrade to 10.2.10-h39 or later. | \n
| \n | 10.2.0 through 10.2.7-h* | \nUpgrade to 10.2.7-h36 or later. | \n
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access All | No action needed. |