CVE-2026-0249
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative OS user or an attacker on the same subnet can redirect traffic to an unauthorized server and facilitate malicious software installation. The GlobalProtect app on Linux, Windows, iOS, and GlobalProtect UWP are not affected.
Risk Assessment
The risk includes interception of sensitive data transmitted over encrypted connections and installation of malicious software on endpoints, potentially leading to data integrity and confidentiality breaches within the organization.
Recommendation
Immediately update the Palo Alto Networks GlobalProtect app to the latest patched version and implement network traffic monitoring to detect redirection attempts.
Other vulnerabilities in Palo Alto Networks GlobalProtect
See all- CVE-2026-0295High
A race condition in the Palo Alto Networks GlobalProtect client on macOS allows a locally authenticated low-privileged attacker to escalate privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
- CVE-2026-0267Medium
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS allows a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the app. After obtaining the passcode, the user can perform these actions even if the configuration would not normally permit it.
- CVE-2026-0251High
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux.
- CVE-2026-0250High
A buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. The vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway.
Original NVD description (English source)
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS