Description
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App | 6.3.0 – < 6.3.3-h9 (6.3.3-999), 6.2.0 – < 6.2.8-h10 (6.2.8-948), 6.0.0 – < 6.0.13, 6.3.0 – < 6.3.3-h2 (6.3.3-42), 6.0.0 – < 6.0.11 | 6.3.3-h9 (6.3.3-999) |
| Palo Alto Networks | Global Protect App | — | All |
Advisories 2
- WID-SEC-2026-1542 Google Chrome und Microsoft Edge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-1535 Palo Alto Networks GlobalProtect App: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2026
References
- https://security.paloaltonetworks.com/CVE-2026-0251 vendor-advisory