Skip to content
CVE PROGRAM SOURCE RECORD4.1 Medium

CVE-2026-0295

GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks GlobalProtect App

Default version status: unaffected

  • 6.3.0 to < 6.3.3-h14 (6.3.3-1121)affected
  • 6.2.0 to < 6.2.8-h13 (6.2.8-1045)affected
  • 6.0.0 to < 6.0.15affected

Palo Alto Networks GlobalProtect App

Default version status: unaffected

  • Allunaffected

References