CVE-2026-0315
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
Description
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Weakness: CWE-426
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect | VPN & Remote Access | cna-assigner |
Vendor-reported products (2)
- Palo Alto Networks · GlobalProtect App
- Palo Alto Networks · GlobalProtect App — vendor states not affected
Credit
Ronen Seleri and Shahaf Pruss of Blyde Labs
Vendor remediation
Version Minor VersionSuggested SolutionGlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h15Upgrade to 6.3.3-h16 (6.3.3-1199) or later.GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h14 Upgrade to 6.2.8-h15 (6.2.8-1084) or later.GlobalProtect App on Linux No action needed.GlobalProtect App on Windows No action needed.GlobalProtect App on iOS No action needed.GlobalProtect App on Android No action needed.GlobalProtect App on ChromeOS No action needed.