GlobalProtect App CVE-2026-0307

Exploitation requires an authenticated local user session on a Windows, macOS, or Linux system running an affected GlobalProtect App version (6.0.x < 6.0.15, 6.2.x < 6.2.8-h14, or 6.3.x < 6.3.3-h15). The attacker needs only standard (non-administrative) OS user privileges-PR:L per the CVSS vector. No network access is required (AV:L). No user interaction beyond the attacker's own actions is needed (UI:N). Exploitation is limited to desktop/laptop platforms: Windows, macOS, and Linux. GlobalProtect on iOS, Android, and ChromeOS is explicitly excluded. There is no known requirement for a specific GlobalProtect configuration or feature to be enabled beyond the application being installed and running its privileged service or daemon.

The reported CVSS 4.0 base score of 5.9 is materially reduced from the raw impact potential by the threat metric E:U (Exploitation Unlikely), which the vendor has embedded in the provided vector. Without that threat adjustment, the base AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H metrics represent a straightforward, low-friction local privilege escalation with full system compromise potential. In CVSS 3.1 terms this is a 7.8 HIGH. Realistic risk is meaningful in enterprise environments: any local user account-including service accounts or lightly-privileged contractor accounts-on an affected Windows, macOS, or Linux endpoint can achieve SYSTEM or root. As a VPN client installed on managed corporate laptops, exploitation would enable persistent access, credential harvesting, and lateral movement through the VPN tunnel to internal networks. EPSS data is absent from the provided intelligence; KEV status is negative and no POC is known, so opportunistic mass exploitation is not a current signal. The 'GlobalProtect App All' entry in affected versions suggests broad version exposure across the 6.x train. There is no CVSS vector conflict-AV:L correctly reflects the local-user-required attack surface.

A low-privileged domain user with interactive logon rights to a corporate laptop running an unpatched GlobalProtect 6.2.x client identifies a user-writable directory in the application's DLL or executable search path. The attacker plants a malicious DLL or binary in that path, then triggers a GlobalProtect operation-such as a VPN connection attempt or service restart-that causes the SYSTEM-level service process to load the attacker-controlled file. Code executes as NT AUTHORITY\SYSTEM, granting complete control of the endpoint. No public POC is known at time of analysis.