CVE-2026-0307: Palo Alto Networks Globalprotect App

Medium severity, CVSS 5.9. EPSS: 0.1% chance of exploitation in the next 30 days.

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

Affected products

• Palo Alto Networks Globalprotect App: from 6.3.0, before 6.3.3-h15 (fixed in 6.3.3-h15); from 6.0.0, before 6.0.15 (fixed in 6.0.15); from 6.2.0, before 6.2.8-h14 (fixed in 6.2.8-h14); any version

Published 2026-09-10. Last modified 2026-09-11.