GlobalProtect App CVE-2026-0251

Exploitation requires an existing local OS session with at least standard (non-administrative) user privileges - confirmed by CVSS PR:L (Low Privileges Required). The attacker must have write access to at least one directory that the GlobalProtect privileged process searches before the legitimate binary location, which is the defining condition of CWE-426. No additional target conditions are required (AT:N) and no user interaction from a victim is needed once the malicious binary is placed (UI:N). Exploitation is not automatable per SSVC, ruling out remote or network-propagated attacks - physical access or a pre-existing foothold on the endpoint is mandatory. The vulnerability is limited to Windows, macOS, and Linux; GlobalProtect on iOS, Android, Chrome OS, and the UWP variant is explicitly not vulnerable. Exploitation probability is further bounded by the 0.01% EPSS score and SSVC exploitation status of none at time of analysis.

The CVSS 4.0 score of 5.9 (Medium) is calibrated by the local access requirement (AV:L) and low-privilege prerequisite (PR:L), which cap the score despite high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). EPSS at 0.01% (0th percentile) signals negligible near-term exploitation probability in the wild, consistent with SSVC confirming exploitation status as 'none' and automatable as 'no' - remote or mass exploitation is not feasible. The E:U (Unexploited) metric in the CVSS 4.0 supplemental vector corroborates this. Despite these low-exploitation signals, SSVC rates technical impact as 'total,' which is accurate: a successful exploit yields complete OS control. Real-world priority is highest in shared-endpoint environments (VDI, shared workstations, kiosks) where untrusted local users coexist with the GlobalProtect client; in standard single-user enterprise laptops, the threat is substantially mitigated by the requirement for pre-existing local access. The CVSS supplemental Recovery:User and Value Density:Diffuse indicators suggest the vendor views this as a moderate operational recovery burden affecting distributed endpoints rather than a concentrated high-value target.

A non-administrative user logged into a corporate Windows endpoint running a vulnerable GlobalProtect App version identifies that a GlobalProtect background service resolves a binary or DLL from a directory writable by standard users. The attacker places a crafted malicious DLL or executable in that directory with the expected name, then triggers or waits for the GlobalProtect service to restart or execute its scheduled task. The service loads the malicious binary under NT AUTHORITY\SYSTEM context, granting the attacker full administrative control of the endpoint. No public exploit code has been identified at time of analysis.