GlobalProtect App CVE-2026-0249

The attack requires the attacker to be positioned on the same network subnet as the victim (AV:A), either as a local non-administrative OS user on the same host or as a network-adjacent attacker using techniques such as ARP poisoning or a rogue access point. No authentication or privileges are required by the attacker (PR:N), and no user interaction beyond normal VPN usage is needed (UI:N). The vulnerability is limited to specific GlobalProtect App platforms: macOS and Android are affected, while Linux, Windows, iOS, and the UWP app are explicitly confirmed unaffected by the vendor. The CVSS 4.0 AT:P component confirms that target-side prerequisites exist - specifically the vulnerable OS platform and a GlobalProtect App version below the respective fix threshold must be present. Exploitation is further constrained by the requirement for adjacent network access, making internet-scale mass exploitation infeasible without first compromising network positioning.

The CVSS 4.0 base score of 4.9 (Medium) is primarily suppressed by AV:A (adjacent network required, not internet-wide), AT:P (target-side prerequisites - specific OS platforms), and E:U (exploitation unreported). Despite these mitigating factors, the vulnerable component impact is rated VC:H and VI:H, meaning a successful attack fully compromises confidentiality and integrity of data passing through the VPN tunnel. EPSS at 0.00% (0th percentile) aligns with SSVC's 'Exploitation: none' and 'Automatable: no' ratings, indicating no observed mass exploitation and no straightforward weaponization path. The Amber urgency rating from the CVSS 4.0 supplemental vector (U:Amber) suggests the vendor views this as moderately time-sensitive. One data inconsistency worth flagging: the CVE tags include 'Microsoft', yet the description explicitly states Windows is not affected - this tag appears to be erroneous and should not inform risk decisions. Real-world priority is moderate: organizations with road-warrior macOS or Android GlobalProtect users connecting over untrusted networks (public Wi-Fi, hotel networks, conference venues) face the highest realistic exposure. Enterprise environments where all VPN users operate over trusted corporate infrastructure have lower practical risk.

An attacker positioned on the same network subnet as a macOS or Android GlobalProtect user - for example, an attacker sharing a hotel or airport Wi-Fi network - performs ARP spoofing or operates a rogue access point to intercept the victim's traffic. When the GlobalProtect app attempts to authenticate or communicate with its gateway, the attacker presents a fraudulent TLS certificate that the app accepts due to the improper validation flaw, allowing full decryption and manipulation of the VPN-protected channel. The attacker then redirects software update or configuration traffic to a malicious server and delivers a trojanized payload to the endpoint, achieving code execution without requiring any administrative privileges or user interaction beyond the victim's normal VPN usage.