EUVD-2026-57710
GHSA-grg9-vqcx-frvj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Adjacent attack vector with High complexity because MitM positioning is a non-trivial prerequisite; user interaction required as victim must be actively using the app; no privileges needed by attacker.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
3DescriptionCVE.org
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
AnalysisAI
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have an established man-in-the-middle network position between the GlobalProtect client and the Palo Alto Networks portal or gateway - specifically, adjacency to the victim's network segment (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk profile is moderate despite High confidentiality and integrity sub-scores, because exploitation depends on a non-trivial prerequisite: physical or logical adjacency to the victim's network combined with an established MitM position (AT:P in CVSS 4.0). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patched version of the GlobalProtect app as detailed in the Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0296. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Globalprotect App
View allLocal privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-admi
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle att
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary cod
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker p
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or un
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today