GlobalProtect App CVE-2026-0296

Exploitation requires the attacker to have an established man-in-the-middle network position between the GlobalProtect client and the Palo Alto Networks portal or gateway - specifically, adjacency to the victim's network segment (AV:A). The victim must be actively using the GlobalProtect application (UI:P - passive user interaction such as connecting or authenticating). No authentication or special privileges are required from the attacker's perspective (PR:N). Exploitation is limited to desktop platforms; iOS, Android, and Chrome OS clients are unaffected. VPN tunnel traffic itself is not interceptable through this flaw - only ancillary application communications are exposed. The AT:P designation in CVSS 4.0 confirms that specific attack conditions (network adjacency and MitM positioning) must pre-exist, ruling out remote unauthenticated exploitation from arbitrary internet locations.

The overall risk profile is moderate despite High confidentiality and integrity sub-scores, because exploitation depends on a non-trivial prerequisite: physical or logical adjacency to the victim's network combined with an established MitM position (AT:P in CVSS 4.0). The CVSS 4.0 score of 4.5 and Urgency:Amber classification reflect this accurately. EPSS data is not provided; given E:U (exploitation unreported) and the adjacency requirement, opportunistic mass exploitation is implausible. The attack is not automatable (AU:N), further constraining at-scale risk. That said, targeted attacks against high-value enterprise users - particularly those connecting from untrusted networks such as hotel Wi-Fi or conference venues - remain realistic. Even a mid-sized enterprise IT team in kalisz managing remote workers on public networks should evaluate whether their GlobalProtect deployment version falls within the affected range and prioritize patching for road-warrior user populations. The exclusion of iOS, Android, and Chrome OS narrows the attack surface to desktop platforms, reducing but not eliminating exposure. No CISA KEV listing and no public exploit code lower urgency relative to a fully confirmed in-the-wild exploited flaw.

An attacker positions themselves between a GlobalProtect desktop client user and the network - for example by operating a rogue Wi-Fi access point at a public venue or by ARP-spoofing on a shared LAN - and presents a fraudulent TLS certificate that the GlobalProtect app fails to properly validate. The attacker then passively reads or actively modifies application-layer communications (portal authentication, configuration data, telemetry) as they transit the manipulated connection. No public proof-of-concept exploit code has been identified at the time of this analysis.