GlobalProtect App CVE-2026-0298

The Pre-Logon Access Provider (PLAP) feature must be explicitly configured and active in the GlobalProtect app deployment on Windows - PLAP is not enabled in a default GlobalProtect installation and must be deliberately configured by an administrator for pre-logon VPN use cases. The CVSS 4.0 AT:P metric confirms this specific attack requirement. Additionally, the attacker must occupy a man-in-the-middle network position on the same adjacent network segment as the target Windows client during the PLAP-driven pre-logon VPN handshake (CVSS AV:A). No authentication on the target system is required (PR:N), and no victim user interaction is needed (UI:N) since the PLAP component operates autonomously before logon. Exploitation is limited by two independent prerequisites: achieving network adjacency with MitM capability AND targeting an endpoint with PLAP specifically configured. All non-Windows GlobalProtect clients (Linux, macOS, iOS, Android, Chrome OS) are explicitly not vulnerable regardless of configuration.

The vendor-provided CVSS 4.0 score of 5.2 reflects meaningful real-world mitigating factors: the attacker must achieve a network-adjacent MitM position (AV:A) and the PLAP feature must be explicitly configured (AT:P), neither of which is trivially satisfied in a defended enterprise environment. Despite the moderate aggregate score, the C/I/A impact on the vulnerable system is rated High across all three dimensions - SYSTEM-level arbitrary code execution before user logon represents complete host compromise. Even a mid-sized municipal IT team in bytom should treat this as urgent if their Windows fleet uses PLAP for pre-logon domain connectivity, since the attack surface exists throughout the machine's powered-on lifecycle, not just during authenticated sessions. The supplemental CVSS 4.0 E:U metric (Exploitation: Unreported) confirms no public exploit code has been observed, and the AU:N (Automatable: No) metric indicates mass opportunistic scanning is not feasible - the attack requires deliberate targeting and network positioning. This is not a high-CVSS-but-low-real-risk case: the impact ceiling is catastrophic for any affected host, but the realistic attacker population is constrained to those with adjacent network access and knowledge of the target's PLAP configuration. Organizations on untrusted or shared network segments (hotel Wi-Fi, conference networks, managed Wi-Fi without 802.1X) with PLAP-configured endpoints face materially elevated risk.

An attacker on the same network segment as a Windows endpoint running GlobalProtect with PLAP enabled positions themselves as a man-in-the-middle between the client and the GlobalProtect gateway during the pre-logon VPN establishment phase - for example, via ARP spoofing on a corporate LAN or rogue access point on a Wi-Fi segment. The attacker injects malformed input into the PLAP component's network-facing input handling, triggering the CWE-94 code injection flaw; no public exploit code demonstrating this specific technique has been identified at time of analysis. The injected payload executes with SYSTEM privileges before any user has authenticated to Windows, yielding full control of the host.