EUVD-2026-57709
GHSA-c668-xghx-7pj9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Race condition requires precise timing (AC:H); local low-privileged account needed (AV:L/PR:L); root escalation changes scope with full C/I impact (S:C/C:H/I:H); no availability impact per description.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
AnalysisAI
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a locally authenticated low-privileged account (PR:L per CVSS 4.0) on a macOS system with GlobalProtect App installed and actively running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.1 (Medium) accurately represents real-world exploitability given the cumulative constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patched version of the GlobalProtect App for macOS as specified in the Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0295 - the exact fixed version must be confirmed there, as available CPE data uses wildcards without identifying a specific patch release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Globalprotect App
View allLocal privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-admi
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle att
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary cod
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker p
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an estab
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or un
Same weakness CWE-362 – Race Condition
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today