EUVD-2026-101672
GHSA-xpxj-xmc7-f5qw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local Windows user
-
ExploitTrigger type confusion in GlobalProtect app
-
ImpactCrash client causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated local user with at least low privileges (PR:L) on a Windows host running an affected version of the GlobalProtect app (6.3.0 before 6.3.3-h16, 6.2.0 before 6.2.8-h15, or 6.0.0 before 6.0.15). The flaw is Windows-specific: the GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is explicitly not affected, which sharply limits the exposed population. There is no remote attack surface (AV:L) and no network-facing vector; impact is confined to crashing the local client (availability-only), with no confidentiality or integrity consequence and no privilege escalation or lateral movement. |
| Impact | This is a low-to-moderate priority issue despite being tracked as a CVE. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a locally-exploitable flaw requiring an already-authenticated low-privileged user on the Windows host, with impact limited strictly to availability of the vulnerable system (VC:N/VI:N/VA:H) - no confidentiality or integrity loss and no scope change. The exploit maturity metric E:U (Unreported) indicates no known exploitation and no public exploit code, and the vulnerability is NOT in CISA KEV. No EPSS score was supplied in the input. SSVC-style reasoning: exploitation status is 'none,' technical impact is partial (availability-only DoS), and it is not trivially automatable at scale because it requires local authenticated access to each target. In short, the signals are consistent and point to a genuinely low real-world risk: a local user can only crash their own GlobalProtect client, not pivot, escalate, or affect other systems. Note that EPSS is MISSING from the provided data, so probabilistic exploitation likelihood could not be cross-checked. |
| Exploit ScenarioDerived | A low-privileged but authenticated user on a Windows endpoint runs a crafted input or local interaction that triggers a type confusion in the GlobalProtect app, corrupting memory and crashing the client. The result is a denial of service of the VPN client on that single machine, potentially disrupting the user's own secure connectivity. No public exploit code exists (exploit maturity is Unreported), so this would currently require original development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Type confusion in the Palo Alto Networks GlobalProtect app on Windows lets an authenticated local user with low privileges crash the client and produce a denial-of-service condition (CWE-843; vendor CVSS 4.0 score 4.3; assessed CVSS:3.1 4.3 with AV:L/PR:L/UI:N and availability-only impact). Only the Windows client is affected - GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly not vulnerable - so the exposed population is limited to Windows endpoints running GlobalProtect 6.3.0 before 6.3.3-h16, 6.2.0 before 6.2.8-h15, or 6.0.0 before 6.0.15. There is no remote attack surface, no confidentiality or integrity impact, and no privilege escalation or lateral movement, and no public exploit code was identified at time of analysis. Vendor-released patches are available, so this should be treated as a low-to-moderate priority maintenance item rather than an emergency.
RemediationAI
Vendor-released patches are available: upgrade Windows GlobalProtect agents to 6.3.3-h16 (6.3 branch), 6.2.8-h15 (6.2 branch), or 6.0.15 (6.0 branch) as applicable, following the fixed-version guidance at https://security.paloaltonetworks.com/CVE-2026-0314. Treat this as a routine patching item - no public exploit code was identified at time of analysis and there is no indication of active exploitation - but stage the upgrade through your normal endpoint-management tooling since GlobalProtect agents require administrative install rights and a reconnect that briefly drops the user's VPN tunnel. If immediate upgrade of a branch is not possible, compensating controls are limited because the vector is local: enforce least privilege so standard users cannot run arbitrary processes that interact with the GlobalProtect service, and on high-value builds restrict interactive logon to a minimal set of administrators (this reduces the pool of PR:L users who can trigger the crash but degrades normal usability for shared workstations). Note that the local DoS itself is not a strong argument for application-allowlisting changes, and blocking ports or restricting network access to the portal/gateway provides no protection here because the flaw is not reachable remotely. Monitor Windows Application/System event logs for repeated GlobalProtect service or client crashes as a detection signal for attempted triggering, recognizing that such telemetry is noisy and may flag benign faults.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a type confusion flaw (CWE-843): the Windows GlobalProtect client deserializes or otherwise handles an object without validating its runtime type, so a controlled input can be interpreted as a different object than intended, producing memory corruption that terminates the process. This class of bug typically arises from unsafe casting, malformed IPC/IPC-adjacent messages between the GlobalProtect agent and its services, or mishandled pointer unions, and it is the same memory-corruption tag family reflected in the CPE data (cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:*:*:*). Because the attack vector is local (AV:L) with low privileges (PR:L) and no user interaction (UI:N), the fault is reachable by any already-logged-in low-privileged Windows user who can send crafted input to the affected component. The consequence is purely availability (VC:N/VI:N/VA:H): the client crashes, interrupting VPN connectivity for that endpoint, but no code execution, data disclosure, or privilege boundary crossover is demonstrated. Palo Alto Networks scoped the flaw strictly to Windows; the Linux, macOS, iOS, Android, and Chrome OS clients were re-architected or do not process the affected input path, and are recorded as not affected in the same advisory (per EUVD-2026-101672 and the vendor advisory).
Know when Globalprotect App gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Local vector and low complexity with a required authenticated low-privilege user (AV:L/AC:L/PR:L); impact is availability-only DoS (A:H, C:N, I:N) with no scope change.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.
The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Globalprotect App
View allLocal privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-admi
Local privilege escalation in Palo Alto Networks GlobalProtect App versions 6.3.0 before 6.3.3-h16 and 6.2.0 before 6.2.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle att
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary cod
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker p
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an estab
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or un
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable
Exploit-DB