Palo Alto GlobalProtect Vulnerabilities Enable SYSTEM and Root-Level Access

Palo Alto Networks has released security advisories for multiple vulnerabilities in the GlobalProtect App that could allow a local attacker to elevate their privileges to SYSTEM on Windows or to root on Linux and macOS systems.

These advisories were published on August 12, 2026, and the vulnerabilities affect GlobalProtect App versions 6.0, 6.2, and 6.3 across desktop operating systems.

Several fixes are already available, with additional updates for Linux, macOS, Windows, Android, iOS, and ChromeOS scheduled for release later this month.

Palo Alto GlobalProtect Vulnerabilities

The most significant issue, tracked as CVE-2026-0299, is a local privilege escalation vulnerability with a CVSS score of 5.9. An authenticated local attacker could exploit this flaw to gain elevated operating system permissions, potentially converting low-privileged access into control over security-sensitive processes and resources.

The affected versions of the GlobalProtect App include releases before 6.3.3-h15 on Linux and earlier than 6.3.3-h14 (build 6.3.3-1121) on Windows and macOS.

Older branches are also vulnerable: GlobalProtect version 6.2 is affected if it’s below 6.2.8-h13 on Windows and macOS, while version 6.0 is affected if it’s below 6.0.15 across Linux, macOS, and Windows.

Palo Alto Networks has stated that iOS, Android, and ChromeOS are not affected by CVE-2026-0299. Fixes for the 6.3 branches on Windows and macOS are available now, while remediation for Linux is expected by August 28. Patches for the 6.0 branch are scheduled for release on August 31.

The advisory also includes CVE-2026-0298, a Windows-only code execution vulnerability in the GlobalProtect Windows Pre-Logon Access Provider (PLAP). This issue has a CVSS score of 5.2.

It affects versions before 6.3.3-h14 and 6.2.8-h13; version 6.0.15 is expected to resolve the exposure in the legacy branch.

Since PLAP operates before a user session is fully established, code execution flaws in this component require particular attention from enterprises that use GlobalProtect to provide pre-logon VPN connectivity for remote-managed endpoints.

Organizations should check if PLAP is enabled in their deployments and prioritize updates for exposed Windows devices.

Another CVSS 5.2 issue, CVE-2026-0297, is a buffer overflow vulnerability in the UDP tunnel handshake process. This flaw affects GlobalProtect clients on Linux, Windows, macOS, iOS, Android, and ChromeOS.

Although Palo Alto Networks has not classified this vulnerability as critical, memory safety issues in VPN tunnel handling can be significant when combined with other weaknesses.

Additionally, CVE-2026-0296, rated 4.5, addresses an improper certificate validation bypass affecting Linux, Windows, and macOS clients. Exploiting this vulnerability could undermine trust validation controls and increase the risk of man-in-the-middle attacks under certain network conditions.

Administrators should inventory GlobalProtect versions across both managed and unmanaged endpoints, prioritize updates for Windows and Linux systems to prevent SYSTEM or root-level compromises, and deploy available hotfixes immediately.

Until the remaining patches are released, security teams should restrict local administrative access, monitor GlobalProtect processes and services for abnormal behavior, and investigate any unexpected changes to VPN client binaries, configurations, certificates, or privileged system components.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world