This vulnerability in PAN-OS's LSVPN feature allows an unauthenticated attacker with network access to bypass authentication controls and create unauthorized site-to-site VPN connections. This could lead to unauthorized access to network resources across VPN tunnels. The issue is specific to PAN-OS and does not impact Panorama, Cloud NGFW, or Prisma Access products. The CVSS vector indicates the attack requires no privileges or user interaction and has a network attack vector, with partial confidentiality and integrity impact but no availability impact.

An attacker exploiting this vulnerability can bypass authentication mechanisms in the LSVPN functionality, potentially establishing unauthorized VPN connections that could allow access to protected network segments. This compromises confidentiality and integrity of communications over the VPN. There is no reported impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Palo Alto Networks advisories for updates. Panorama, Cloud NGFW, and Prisma Access are not affected, so no action is required for those products.