CVE-2026-0251
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux.
Risk Assessment
An attacker with local access can execute arbitrary commands with administrative privileges, leading to full system and data compromise.
Recommendation
Immediately update the GlobalProtect app to the latest patched version. Restrict local access to systems running the vulnerable version.
Other vulnerabilities in Palo Alto Networks GlobalProtect
See all- CVE-2026-0295Medium
A race condition in the Palo Alto Networks GlobalProtect client on macOS allows a locally authenticated low-privileged attacker to escalate privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
- CVE-2026-0267Medium
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS allows a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the app. After obtaining the passcode, the user can perform these actions even if the configuration would not normally permit it.
- CVE-2026-0250High
A buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. The vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway.
- CVE-2026-0249Medium
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative OS user or an attacker on the same subnet can redirect traffic to an unauthorized server and facilitate malicious software installation. The GlobalProtect app on Linux, Windows, iOS, and GlobalProtect UWP are not affected.
Original NVD description (English source)
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.