FKIE_CVE-2026-0295
Vulnerability from fkie_nvd - Published: 2026-08-13 03:16 - Updated: 2026-09-10 17:12
Severity
Summary
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
References
| URL | Tags | ||
|---|---|---|---|
| psirt@paloaltonetworks.com | https://security.paloaltonetworks.com/CVE-2026-0295 | Vendor Advisory |
Impacted products
{
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14 (6.3.3-1121)",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13 (6.2.8-1045)",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Windows",
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"source": "psirt@paloaltonetworks.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "E3EFFAC2-6103-482C-89FE-2BE4DF0E9B21",
"versionEndExcluding": "6.0.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "84C4C650-DBCF-488A-AD29-84347162D48B",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"matchCriteriaId": "EFAA1A23-5A3C-48FA-8672-D8329D67A14C",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-:*:*:*:macos:*:*",
"matchCriteriaId": "F781BC4A-B907-4393-A94A-D200A0BD73E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h1:*:*:*:macos:*:*",
"matchCriteriaId": "77C49DC4-CC2B-46C3-9122-40B399E657A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h10:*:*:*:macos:*:*",
"matchCriteriaId": "D2676E00-46C3-41DF-A008-682D7F0B2797",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h11:*:*:*:macos:*:*",
"matchCriteriaId": "A8D57611-BDB9-44C1-9236-BD74067BDEF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h12:*:*:*:macos:*:*",
"matchCriteriaId": "0844DC3B-6518-4D49-A16B-36804669F2C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h2:*:*:*:macos:*:*",
"matchCriteriaId": "4DBD083E-213A-40AD-B8C6-57209E672423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h3:*:*:*:macos:*:*",
"matchCriteriaId": "81D762BB-0AE4-4208-977F-2EB0F85E6D2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h4:*:*:*:macos:*:*",
"matchCriteriaId": "9DE9EED3-7A82-4492-B24F-952FC22744DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h5:*:*:*:macos:*:*",
"matchCriteriaId": "7D33C2E7-D874-4E20-9689-1709651C2880",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h6:*:*:*:macos:*:*",
"matchCriteriaId": "4E44CD2E-32D9-4B52-B51F-D27AC985E94E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7:*:*:*:macos:*:*",
"matchCriteriaId": "9F6A6D49-B2DE-4359-83B3-D3239559CE64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h8:*:*:*:macos:*:*",
"matchCriteriaId": "C95F6D0E-A3D6-4026-BB36-251EFEBE2A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h9:*:*:*:macos:*:*",
"matchCriteriaId": "3FA7578D-5914-4E29-87A1-693EA2F574AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:-:*:*:*:macos:*:*",
"matchCriteriaId": "47AAC03D-0E33-430D-AB58-CABCC1546285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:macos:*:*",
"matchCriteriaId": "1BCA9A56-9AFB-4C97-B597-C3F1DC786A35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h11:*:*:*:macos:*:*",
"matchCriteriaId": "19BE182F-43CA-476D-B0FF-64E191AC2B29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h12:*:*:*:macos:*:*",
"matchCriteriaId": "7DE98D24-3659-4FBB-9C58-84D8A3FB4081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2:*:*:*:macos:*:*",
"matchCriteriaId": "D3632AD0-54EB-4CA4-AB41-983B6965B30E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3:*:*:*:macos:*:*",
"matchCriteriaId": "82E3F152-A98F-4B12-B9B7-8F2E3DB8A6A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4:*:*:*:macos:*:*",
"matchCriteriaId": "EC0A413D-5F2C-4FE8-ADE6-A78244A7E132",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6:*:*:*:macos:*:*",
"matchCriteriaId": "B7A8F2F7-85C7-4456-9E71-F94F3DF96356",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7:*:*:*:macos:*:*",
"matchCriteriaId": "7472FAD0-A40D-437A-82DA-70A7B959A62C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8:*:*:*:macos:*:*",
"matchCriteriaId": "B6C0F18B-802C-43D5-AEDD-05B7E5A53CED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9:*:*:*:macos:*:*",
"matchCriteriaId": "50E2642D-EB58-4B5D-B218-F5E6DB97D382",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A race condition in the Palo Alto Networks GlobalProtect\u2122 client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"id": "CVE-2026-0295",
"lastModified": "2026-09-10T17:12:10.887",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "UNREPORTED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"source": "psirt@paloaltonetworks.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-0295",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:55.918274Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-13T03:16:44.493",
"references": [
{
"source": "psirt@paloaltonetworks.com",
"tags": [
"Vendor Advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0295"
}
],
"sourceIdentifier": "psirt@paloaltonetworks.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "psirt@paloaltonetworks.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…