CVE-2026-0307: GlobalProtect App: Local Privilege Escalation Vulnerabilities
CVE-2026-0307
Summary
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.
The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.
Products covered
GlobalProtect App
GlobalProtect App 6.3
GlobalProtect App 6.2
GlobalProtect App 6.1
GlobalProtect App 6.0
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
GlobalProtect App 6.1 on Android | 6.1.0 through 6.1.13 | Upgrade to 6.1.14 or later. |
GlobalProtect App 6.0 on Android | 6.0.0 through 6.0.13 | Upgrade to 6.0.14 or later. |
GlobalProtect App 6.1 on Chrome OS | 6.1.0 through 6.1.13 | Upgrade to 6.1.14 or later. |
GlobalProtect App 6.0 on Chrome OS | 6.0.0 through 6.0.13 | Upgrade to 6.0.14 or later. |
GlobalProtect App 6.3 on macOS | 6.3.0 through 6.3.3-h8 | Upgrade to 6.3.3-h9 (6.3.3-999) or later. |
GlobalProtect App 6.2 on macOS | 6.2.0 through 6.2.8-h9 | Upgrade to 6.2.8-h10 (6.2.8-948) or later. |
GlobalProtect App 6.0 on macOS | 6.0.0 through 6.0.12 | Upgrade to 6.0.13 or later. |
GlobalProtect App on Windows | No action needed. | |
GlobalProtect App on Linux | No action needed. | |
GlobalProtect App on iOS | No action needed. | |
GlobalProtect App on UWP | No action needed. |
Vendor-listed fixes
GlobalProtect App 6.3 >= 6.3.3-h9 (6.3.3-999) on macOS
GlobalProtect App 6.2 >= 6.2.8-h10 (6.2.8-948) on macOS
GlobalProtect App 6.1 >= 6.1.14 on Android, >= 6.1.14 on ChromeOS
GlobalProtect App 6.0 >= 6.0.14 on Android, >= 6.0.14 on ChromeOS, >= 6.0.13 on macOS
GlobalProtect App All on Windows, All on Linux, All on iOS, All on Windows UWP
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Updated by Palo Alto Networks
The vendor changed the advisory after it was first published.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.