Skip to main content

GlobalProtect App CVE-2026-0299

| EUVDEUVD-2026-57713 MEDIUM
Untrusted Search Path (CWE-426)
2026-08-13 palo_alto GHSA-v8f9-pq46-34r9
Privilege Escalation Apple Microsoft Google Paloalto Globalprotect App
5.9
CVSS 4.0 · Vendor: palo_alto
Share

Severity by source

Vendor (palo_alto) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
vuln.today AI
7.8 HIGH

Local access with low-privilege account sufficient (AV:L/PR:L); no interaction needed; full SYSTEM/root compromise justifies C:H/I:H/A:H; scope unchanged as impact is contained to the compromised host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 13, 2026 - 03:02 vuln.today
Patch available
Aug 13, 2026 - 03:01 EUVD
CVE Published
Aug 13, 2026 - 02:04 cve.org
MEDIUM 5.9

DescriptionCVE.org

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, and Chrome OS is not affected.

AnalysisAI

Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold an existing local non-administrative user account on the target desktop system running GlobalProtect on Windows, macOS, or Linux - remote unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) confirms that exploitation requires only a local low-privileged account and no special attack conditions, making it straightforward for any interactive user on an affected desktop. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the patched GlobalProtect app version identified in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0299 - exact fix versions are not independently confirmed from available data and must be sourced directly from the vendor bulletin. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Globalprotect App

View all
CVE-2026-0251 MEDIUM
5.9 May 13

Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a

CVE-2026-0298 MEDIUM
5.2 Aug 13

Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle att
CVE-2026-0297 MEDIUM
5.2 Aug 13

Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary cod
CVE-2026-0250 MEDIUM
5.2 May 13

Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker p
CVE-2026-0249 MEDIUM
4.9 May 13

Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-
CVE-2026-0296 MEDIUM
4.5 Aug 13

Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an estab
CVE-2026-0267 MEDIUM
4.4 Jun 10

GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or un
CVE-2026-0295 MEDIUM
4.1 Aug 13

Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable

Same weakness CWE-426 – Untrusted Search Path

View all
CVE-2015-0096 CRITICAL POC
9.3
CVE-2012-1854 HIGH POC
7.8
CVE-2016-5330 HIGH POC
7.8
CVE-2019-11660 HIGH POC
7.8
CVE-2017-12414 CRITICAL POC
9.8
CVE-2025-26155 CRITICAL POC
9.8
CVE-2023-30330 CRITICAL POC
9.8
CVE-2023-26036 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-0299 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy