CVE-2026-0251

GlobalProtect App: Local Privilege Escalation Vulnerabilities

State: Published
Severity: 5.9 Medium
Published: May 13, 2026
Updated: May 14, 2026
Reserved: Nov 3, 2025

Description

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto

Weaknesses

CWE-426 Untrusted Search Path

Affected Products

Product	Versions
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.3-h9 (6.3.3-999)Affectedfrom 6.3.3-h9 (6.3.3-999)Not affected 6.2.0 to before 6.2.8-h10 (6.2.8-948)Affectedfrom 6.2.8-h10 (6.2.8-948)Not affected 6.0.0 to before 6.0.13Affectedfrom 6.0.13Not affected
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.3-h9 (6.3.3-999)Affectedfrom 6.3.3-h9 (6.3.3-999)Not affected 6.2.0 to before 6.2.8-h10 (6.2.8-948)Affectedfrom 6.2.8-h10 (6.2.8-948)Not affected 6.0.0 to before 6.0.13Affectedfrom 6.0.13Not affected
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.3-h2 (6.3.3-42)Affectedfrom 6.3.3-h2 (6.3.3-42)Not affected 6.0.0 to before 6.0.11Affectedfrom 6.0.11Not affected
Global Protect AppPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2026-0251vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.