Status: UPDATED | Advisory ID: CVE-2026-0295
| CVE | CVE-2026-0295 |
| CVSS | CVSS 7.0 (High): attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| Affected products | Palo Alto Networks GlobalProtect |
| Exploitation status | Palo Alto Networks is not aware of any malicious exploitation of this issue. |
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
GlobalProtect App 6.3 on macOS (6.3.0 through 6.3.3-h13): upgrade to 6.3.3-h14 (6.3.3-1121) or later. 6.2 on macOS (6.2.0 through 6.2.8-h12): upgrade to 6.2.8-h13 (6.2.8-1045) or later. 6.0 on macOS (6.0.0 through 6.0.14): upgrade to 6.0.15 or later. All other platforms: no action needed. Workarounds and Mitigations: no known workarounds.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-0295 |
| Vendor advisory | https://security.paloaltonetworks.com/CVE-2026-0295 |