CVE-2026-0307: GlobalProtect App: Local Privilege Escalation Vulnerabilities
CVE-2026-0307
Summary
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.
The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.
Products covered
GlobalProtect App
GlobalProtect App 6.3
GlobalProtect App 6.2
GlobalProtect App 6.0
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
GlobalProtect App 6.3 on Windows | 6.3.0 through 6.3.3-h15 | Upgrade to 6.3.3-h16 (6.3.3-1199) or later. |
GlobalProtect App 6.2 on Windows | 6.2.0 through 6.2.8-h14 | Upgrade to 6.2.8-h15 (6.2.8-1084) or later. |
GlobalProtect App 6.0 on Windows | 6.0.0 through 6.0.14 | Upgrade to 6.0.15 or later. |
GlobalProtect App on Linux | No action needed. | |
GlobalProtect App on macOS | No action needed. | |
GlobalProtect App on iOS | No action needed. | |
GlobalProtect App on Android | No action needed. | |
GlobalProtect App on Chrome OS | No action needed. | |
All older unsupported GlobalProtect App versions | Upgrade to a supported fixed version. |
Vendor-listed fixes
GlobalProtect App 6.3 >= 6.3.3-h16 (6.3.3-1199) on Windows
GlobalProtect App 6.2 >= 6.2.8-h15 (6.2.8-1084) on Windows
GlobalProtect App 6.0 >= 6.0.15 on Windows
GlobalProtect App All on Linux, All on macOS, All on iOS, All on Android, All on Chrome OS
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.