CVE-2026-0250
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. The vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway.
Risk Assessment
An attacker can gain full system control with the highest privileges, leading to complete device compromise and potential lateral movement within the organization's network.
Recommendation
Immediately update the GlobalProtect app to the latest version provided by Palo Alto Networks and implement man-in-the-middle attack protections such as strong authentication and traffic encryption.
Other vulnerabilities in Palo Alto Networks GlobalProtect
See all- CVE-2026-0295Medium
A race condition in the Palo Alto Networks GlobalProtect client on macOS allows a locally authenticated low-privileged attacker to escalate privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
- CVE-2026-0267Medium
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS allows a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the app. After obtaining the passcode, the user can perform these actions even if the configuration would not normally permit it.
- CVE-2026-0251High
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux.
- CVE-2026-0249Medium
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative OS user or an attacker on the same subnet can redirect traffic to an unauthorized server and facilitate malicious software installation. The GlobalProtect app on Linux, Windows, iOS, and GlobalProtect UWP are not affected.
Original NVD description (English source)
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected.