What’s Vulnerable › Vulnerabilities

CVE-2026-0251: GlobalProtect App: Local Privilege Escalation Vulnerabilities

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-10-26
• Weakness: CWE-426

Description

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

Affected products

• Palo Alto Networks GlobalProtect App: from 6.0.0 before 6.0.11; from 6.0.0 before 6.0.13; from 6.2.0 before 6.2.8; from 6.3.0 before 6.3.3; 6.2.8, 6.2.8-h1, 6.2.8-h7, 6.3.3, 6.3.3-h1, 6.3.3-h2 (+6) — fixed in 6.0.11, 6.0.13, 6.2.8, 6.3.3
• Palo Alto Networks GlobalProtect App: from 6.3.0 before 6.3.3-h9 (6.3.3-999); from 6.2.0 before 6.2.8-h10 (6.2.8-948); from 6.0.0 before 6.0.13 — fixed in 6.3.3-h9 (6.3.3-999), 6.2.8-h10 (6.2.8-948), 6.0.13

How to fix

Upgrade to a fixed version: Palo Alto Networks GlobalProtect App 6.0.11, 6.0.13, 6.2.8, 6.3.3; Palo Alto Networks GlobalProtect App 6.3.3-h9 (6.3.3-999), 6.2.8-h10 (6.2.8-948), 6.0.13. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2026-0251

Get alerted when CVE-2026-0251 or the next vulnerability affects your stack