mediumQCS priority 76/100Palo Alto Networks

CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)

A security flaw in the GlobalProtect App allows a local user on Windows, macOS, or Linux systems to increase their access rights to full administrative privileges. This means someone with limited access could run commands as if they were an administrator, which poses a medium-level security risk. The issue does not affect iOS, Android, or ChromeOS versions of the app. Palo Alto Networks has released updated versions to address this vulnerability and advises users to upgrade both the GlobalProtect app and PAN-OS to fully fix the problem.

QCS published 16/9/2026, 7:11:17 am ISTVendor disclosure 30/9/2026, 11:45:00 am ISTVerified 5/10/2026, 11:38:44 am ISTRevision 3

In plain language

What this advisory means

Technical explanation

How the issue affects the environment

The vulnerability involves multiple local privilege escalation weaknesses in the GlobalProtect App that permit a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. The attacker can execute arbitrary commands with elevated privileges without requiring user interaction or specific configurations. The flaw is related to CWE-426 Untrusted Search Path and is exploitable via local access (e.g., keyboard, SSH). To remediate, Palo Alto Networks requires upgrades to specific minor versions of GlobalProtect on Windows, macOS, and Linux, as well as PAN-OS upgrades, ensuring all components are patched for complete mitigation.

Operational impact

Why teams should care

If unaddressed, this vulnerability allows non-administrative users to gain full administrative control over affected systems, potentially compromising sensitive data and system integrity. This can lead to unauthorized actions, system misconfigurations, or further exploitation within the organization’s IT environment, threatening confidentiality, integrity, and availability of systems relying on GlobalProtect. The medium severity indicates a moderate risk requiring timely remediation to avoid potential operational disruptions or breaches.

Immediate action

Upgrade all affected GlobalProtect App installations to the specified fixed versions. Additionally, upgrade all PAN-OS deployments to the versions that contain the fixes. Prisma Access customers should also ensure their environments are upgraded to the referenced fixed versions. Coordinated upgrading of both client and infrastructure components is mandatory to fully remediate the vulnerability. Engage Palo Alto Networks Support or account teams for on-demand upgrade scheduling if needed.

Affected and fixed releases

Affected versionsGlobalProtect App 6.0.0 up to but excluding 6.0.15 on Windows, macOS, Linux, GlobalProtect App 6.2.0 up to but excluding 6.2.8-h14 on Windows, macOS, GlobalProtect App 6.3.0 up to but excluding 6.3.3-h15 on Windows, macOS, Linux, PAN-OS versions 10.2.0 through 12.2.2 in multiple intermediate subversions, Prisma Access versions 10.2.0 through 12.1.* in multiple intermediate subversions

Fixed versionsGlobalProtect App 6.0.15 or later on Windows, macOS, Linux, GlobalProtect App 6.2.8-h14 or later on Windows, macOS, GlobalProtect App 6.3.3-h15 or later on Windows, macOS, Linux, PAN-OS 10.2.18-h10 or later, 11.1.16 or later, 11.2.13-h2 or later, 12.1.10 or later, 12.2.3 or later, Prisma Access 10.2.10-h40 or later, 11.2.7-h20 or later, 12.1.7-h5 or later

Temporary risk reduction

No known workarounds exist. Immediate software updates are required to mitigate the risk.

Evidence and validation checklist

Official Palo Alto Networks Security Advisories page for CVE-2026-0307
Published advisory dated 2026-09-09 with updates through 2026-09-30
Detailed version applicability and upgrade paths
Statements on exploit maturity as UNREPORTED and attack vector LOCAL
No workarounds available statement
Description of the privilege escalation mechanism
Vendor acknowledgement of discovery and fix
Clarification on unaffected platforms (iOS, Android, ChromeOS)

Authoritative reference

Palo Alto Networks Security Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source