GlobalProtect App EUVD-2026-101670

Exploitation requires the vulnerable GlobalProtect app (versions 6.3.0 before 6.3.3-h16 or 6.2.0 before 6.2.8-h15) to be installed specifically on macOS - the Linux, Windows, iOS, Android and Chrome OS builds are explicitly not affected, so non-macOS deployments carry no exposure. The attacker must already possess an interactive, low-privileged (non-administrative) local account on the Mac (CVSS PR:L, AV:L); no user interaction and no non-default configuration is required (UI:N, AC:L). The principal limiting factors are the mandatory local foothold and existing authenticated access, which prevent any remote or unauthenticated exploitation.

This is a genuine but moderate-priority local privilege escalation (CWE-426, untrusted search path) in the Palo Alto Networks GlobalProtect app on macOS only. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) correctly describes a locally-attackable, low-complexity flaw requiring an already-authenticated low-privileged user (PR:L) and no user interaction, yielding full confidentiality/integrity/availability compromise of the host via root execution. The score of 5.9 is tempered by the Exploit Maturity value E:U (unproven/unexploited), which is consistent with the absence of a CISA KEV listing and no public exploit code - exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; this is a MISSING signal, not a low one. The local-only attack vector materially limits real-world risk: an attacker must already have an interactive foothold on the Mac. Net assessment: a credible post-compromise escalation primitive worth patching on managed macOS fleets, but not an internet-facing or wormable emergency. One cross-source discrepancy to note: the Tags list includes Google and Microsoft, yet the description explicitly states Windows, Android and Chrome OS are NOT affected - verify scope as macOS-only.

A non-administrative user already logged into a macOS endpoint running a vulnerable GlobalProtect app (6.3.0 before 6.3.3-h16, or 6.2.0 before 6.2.8-h15) abuses an untrusted search path / insecure component to have their own code executed by a privileged GlobalProtect process. The result is arbitrary command execution as root from a standard user account. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS requires local access with existing low-level privileges.