GlobalProtect App CVE-2026-0299

The attacker must hold an existing local non-administrative user account on the target desktop system running GlobalProtect on Windows, macOS, or Linux - remote unauthenticated exploitation is not possible. The CVSS 4.0 vector PR:L confirms a standard low-privileged local account is sufficient; no administrative credentials or elevated session are required as a prerequisite. Exploitation requires the ability to write a malicious binary or library to a directory within the GlobalProtect service's untrusted search path (e.g., a user-writable directory appearing before system directories in PATH, or a writable RPATH/RUNPATH location). GlobalProtect on iOS, Android, and Chrome OS is explicitly not affected. Limiting factors include: no network attack vector (local access required), no special non-default configuration needed beyond GlobalProtect being installed, and the attacker needing write access to the specific path the service resolves - which may be constrained by system hardening policies such as restricted user-writable directories or mandatory integrity controls.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) confirms that exploitation requires only a local low-privileged account and no special attack conditions, making it straightforward for any interactive user on an affected desktop. Confidentiality, Integrity, and Availability impacts on the vulnerable system are all High, indicating full host compromise post-exploitation. However, the E:U (Exploit Maturity: Unreported) supplemental metric and 5.9 Medium severity score signal that no public exploit is available, which substantially reduces near-term opportunistic risk. The absence from CISA KEV further confirms no confirmed active exploitation at time of analysis. Real-world risk is concentrated on endpoints where untrusted or shared local accounts exist alongside GlobalProtect - corporate single-user workstations with locked-down account models face lower practical risk than shared terminal or lab environments. The SC/SI/SA all-None metrics mean direct lateral movement is not built into this vulnerability, though SYSTEM/root access trivially enables subsequent lateral movement. CVSS 3.1 equivalent would score approximately 7.8 High - the discrepancy between 3.1 and 4.0 scoring should be noted when comparing with other scored vulnerabilities in the environment.

A local non-administrative user on a corporate Windows laptop with GlobalProtect installed identifies that the GlobalProtect privileged service loads a DLL from a user-writable directory during startup or operation. The attacker places a malicious DLL with the expected name in that writable path; on the next service start or trigger event, GlobalProtect loads the attacker's DLL as NT AUTHORITY\SYSTEM, granting full host control. No public exploit code is confirmed at time of analysis, but CWE-426 exploitation techniques are well-understood and widely documented for privilege escalation on Windows, macOS, and Linux.