In plain language
What this advisory means
A medium-severity security flaw affects Palo Alto Networks GlobalProtect apps on multiple operating systems. When the app connects to a Portal or Gateway, a buffer overflow vulnerability can allow an attacker on the same network to disrupt processes or possibly run harmful code with full system rights. This affects many versions on Windows, macOS, Linux, Android, and ChromeOS, but not iOS. Palo Alto Networks has released updated app versions that fix this problem. No user interaction is needed for an attack, and no exploitation has been reported yet.
Technical explanation
How the issue affects the environment
The vulnerability, tracked as CVE-2026-0250, is a buffer overflow in the GlobalProtect app triggered during request and response processing between the Portal and Gateway components. Exploiting this could enable a man-in-the-middle attacker with adjacent network access to cause system process disruptions or execute arbitrary code with SYSTEM-level privileges. The issue does not require user interaction, has low attack complexity, and no privileges are needed to launch an attack. Versions prior to the specified patch levels on Windows, macOS, Linux, Android, and ChromeOS are affected; iOS is not affected. Patch updates are provided for each OS platform to remediate this out-of-bounds write condition.
Operational impact
Why teams should care
Organizations using vulnerable versions of the GlobalProtect app are at risk of man-in-the-middle attacks that may interrupt system operations or allow attackers to execute code at the highest privilege level. This could compromise system confidentiality, integrity, and availability, leading to potential data breaches, service disruption, or unauthorized control over endpoint devices. Promptly applying the vendor's updates is critical to mitigate the risk and maintain secure remote access infrastructure.
Immediate action
Administrators should review their GlobalProtect app versions across affected operating systems and upgrade to the specific fixed versions or later indicated by Palo Alto Networks for their respective platforms and branches. This update closes the buffer overflow vulnerability. Since no configuration changes are needed to be vulnerable, patching all exposed clients should be prioritized.
Affected and fixed releases
Temporary risk reduction
No known workarounds exist for this vulnerability. Users should ensure their GlobalProtect apps are updated to the patched versions to mitigate the risk.
Evidence and validation checklist
- Palo Alto Networks security advisory page for CVE-2026-0250
- Disclosure date: 2026-05-13, update: 2026-10-02
- Detailed lists of affected and fixed GlobalProtect app versions by platform
- Description of buffer overflow triggered during Portal or Gateway communication
- Statement of no reported exploitation
- Severity rated Medium (CVSS 5.2) with moderate urgency
- No special configuration required to be vulnerable
- Mitigation is upgrading to fixed versions
Authoritative reference
Palo Alto Networks Security Advisories
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.