EUVD-2026-36135
GHSA-vx9j-g89f-rrvx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
Local access and low privileges required to read files; high confidentiality loss from passcode exposure; low availability impact from potential agent disablement; no integrity impact directly.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.
AnalysisAI
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or uninstalling the endpoint agent - to unprivileged local users. A local user who reads the exposed passcode can then bypass endpoint protection controls that are specifically designed to prevent such actions, effectively disabling Palo Alto's endpoint security enforcement on the affected machine. No public exploit exists at time of analysis, and CVSS 4.0 supplemental metrics classify exploitation likelihood as 'Unreported' (E:U), though the impact on security posture is significant given that the passcode mechanism is the primary access control preventing users from circumventing GlobalProtect.
Technical ContextAI
The vulnerability is rooted in CWE-532 (Insertion of Sensitive Information into Log File), meaning GlobalProtect's macOS agent writes administrator-configured passcodes into a file - likely a log, preference file, or configuration artifact - that is readable by non-privileged local users. GlobalProtect passcodes are security controls set by enterprise administrators to lock end users out of modifying or removing the endpoint agent, a common zero-trust enforcement mechanism. When these secrets leak into world-readable or user-readable files, the underlying trust model of the control collapses. Affected products per CPE data include cpe:2.3:a:palo_alto_networks:globalprotect_app and cpe:2.3:a:palo_alto_networks:globalprotect_uwp_app, though the CVE description explicitly names macOS as the affected platform; the inclusion of the UWP (Universal Windows Platform) CPE string is a potential data inconsistency worth vendor clarification.
RemediationAI
The primary remediation is to apply the vendor-released patch per the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0267; however, no specific fixed version number was included in available data and cannot be independently confirmed. Until a patched version is deployed, compensating controls should focus on reducing the exposure window: administrators can rotate GlobalProtect passcodes to invalidate any already-exposed values, though this is reactive rather than preventive. Restricting local user access to GlobalProtect log and configuration directories via macOS file system permissions (where operationally feasible) may limit exposure, but this trade-off risks interfering with normal app operation. Organizations in high-risk environments should consider temporarily removing passcode-only enforcement and supplementing with additional endpoint controls (MDM enrollment lock, Jamf restrictions) until a patch is applied. The related advisory CVE-2024-8687 at https://security.paloaltonetworks.com/CVE-2024-8687 may provide additional context on mitigations applicable across both issues.
More in Globalprotect App
View allLocal privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-admi
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle att
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary cod
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker p
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an estab
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today