{"id":"CVE-2026-0298","state":"PUBLISHED","title":"GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)","description":"An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\n\nThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS  is not affected.","publishedAt":"2026-08-13T02:02:47.196Z","updatedAt":"2026-08-13T13:20:48.963Z","severity":{"score":5.2,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","source":"palo_alto"},"assigner":"palo_alto","products":["Palo Alto Networks GlobalProtect App"],"affected":[{"vendor":"Palo Alto Networks","product":"GlobalProtect App","defaultStatus":"unaffected","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.3-h14","changes":[{"at":"6.3.3-h14","status":"unaffected"}],"versionType":"custom"},{"version":"6.2.0","status":"affected","lessThan":"6.2.8-h13","changes":[{"at":"6.2.8-h13","status":"unaffected"}],"versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.15","changes":[{"at":"6.0.15","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows"],"cpes":["cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"]},{"vendor":"Palo Alto Networks","product":"GlobalProtect App","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected","versionType":"custom"}],"platforms":["Linux","macOS","Android","Chrome OS","iOS"]}],"references":["https://security.paloaltonetworks.com/CVE-2026-0298"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0298.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0298","state":"PUBLISHED","datePublished":"2026-08-13T02:02:47.196Z","dateUpdated":"2026-08-13T13:20:48.963Z","assignerShortName":"palo_alto","assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateReserved":"2025-11-03T20:44:56.118Z"},"containers":{"cna":{"title":"GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)","descriptions":[{"lang":"en","value":"An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\n\nThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS  is not affected."}],"affected":[{"vendor":"Palo Alto Networks","product":"GlobalProtect App","defaultStatus":"unaffected","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.3-h14","changes":[{"at":"6.3.3-h14","status":"unaffected"}],"versionType":"custom"},{"version":"6.2.0","status":"affected","lessThan":"6.2.8-h13","changes":[{"at":"6.2.8-h13","status":"unaffected"}],"versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.15","changes":[{"at":"6.0.15","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows"],"cpes":["cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"]},{"vendor":"Palo Alto Networks","product":"GlobalProtect App","defaultStatus":"unaffected","versions":[{"version":"All","status":"unaffected","versionType":"custom"}],"platforms":["Linux","macOS","Android","Chrome OS","iOS"]}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0298","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.2,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"palo_alto","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","dateUpdated":"2026-08-13T02:02:47.196Z"},"datePublic":"2026-08-12T16:00:00.000Z","impacts":[{"capecId":"CAPEC-242","descriptions":[{"lang":"en","value":"CAPEC-242 Code Injection"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*","versionStartIncluding":"6.3.0","versionEndExcluding":"6.3.3-h14"},{"vulnerable":true,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*","versionStartIncluding":"6.2.0","versionEndExcluding":"6.2.8-h13"},{"vulnerable":true,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.15"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:linux:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:macos:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*"}]}]}],"configurations":[{"lang":"eng","value":"This issue is applicable only to devices configured to use SAML authentication in the GlobalProtect Connect Before Logon (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) feature.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p><span>This issue is applicable only to devices configured to use SAML authentication in the GlobalProtect</span> <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"><span>Connect Before Logon</span></a><span> feature.</span></p>"}]}],"workarounds":[{"lang":"eng","value":"Customers can mitigate the risk of this issue by taking either of the following actions:\n\n 1. Use Connect Before Logon (CBL (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method)) (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) without SAML Authentication\n\n 2. Use Pre-logon with machine certificate (https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-access-vpn-with-pre-logon) instead of Connect Before Logon (CBL).","supportingMedia":[{"type":"text/html","base64":false,"value":"<p><span>Customers can mitigate the risk of this issue by taking either of the following actions:</span></p><ol><li><p><span>Use&nbsp;</span><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"><span>Connect Before Logon (CBL</span></a><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"><span>)</span></a>&nbsp;<span>without SAML Authentication</span></p></li><li><p><span>Use&nbsp;</span><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-access-vpn-with-pre-logon\"><span>Pre-logon with machine certificate</span></a>&nbsp;<span>instead of Connect Before Logon (CBL).</span></p></li></ol>"}]}],"solutions":[{"lang":"eng","value":"VERSION                              MINOR VERSION             SUGGESTED SOLUTION\nGlobalProtect App 6.3 on Windows     6.3.0 through 6.3.3-h13   Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on Windows     6.2.0 through 6.2.8-h12   Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on Windows     6.0.0 through 6.0.14      Upgrade to 6.0.15 or later.\nGlobalProtect App All on macOS                                 No action needed.\nGlobalProtect App All on Linux                                 No action needed.\nGlobalProtect App All on iOS                                   No action needed.\nGlobalProtect App All on Android                               No action needed.\nGlobalProtect App All on Chrome OS                             No action needed.","supportingMedia":[{"type":"text/html","base64":false,"value":"<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n                                    <td>GlobalProtect App 6.3 on Windows<br></td>\n                                    <td>6.3.0 through 6.3.3-h13</td>\n                                    <td>Upgrade to 6.3.3-h14&nbsp;(6.3.3-1121) or later.</td>\n                                </tr><tr>\n                                    <td>GlobalProtect App 6.2 on Windows<br></td>\n                                    <td>6.2.0 through 6.2.8-h12</td>\n                                    <td>Upgrade to 6.2.8-h13&nbsp;(6.2.8-1045) or later.</td>\n                                </tr><tr>\n                                    <td>GlobalProtect App 6.0 on Windows<br></td>\n                                    <td>6.0.0 through 6.0.14</td>\n                                    <td>Upgrade to 6.0.15 or later.</td>\n                                </tr><tr><td>GlobalProtect App All on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>GlobalProtect App All on Linux<br></td><td></td><td>No action needed.</td></tr><tr><td>GlobalProtect App All on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>GlobalProtect App All on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>GlobalProtect App All on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>"}]}],"exploits":[{"lang":"en","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}],"timeline":[{"time":"2026-08-12T16:00:00.000Z","lang":"en","value":"Initial Publication"}],"credits":[{"lang":"en","value":"our internal security research teams","type":"finder"}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"},"x_affectedList":["GlobalProtect App 6.3.3","GlobalProtect App 6.3.2","GlobalProtect App 6.3.1","GlobalProtect App 6.3.0","GlobalProtect App 6.3","GlobalProtect App 6.2.8","GlobalProtect App 6.2.7","GlobalProtect App 6.2.6","GlobalProtect App 6.2.4","GlobalProtect App 6.2.3","GlobalProtect App 6.2.2","GlobalProtect App 6.2.1","GlobalProtect App 6.2.0","GlobalProtect App 6.2","GlobalProtect App 6.0.14","GlobalProtect App 6.0.13","GlobalProtect App 6.0.12","GlobalProtect App 6.0.11","GlobalProtect App 6.0.10","GlobalProtect App 6.0.8","GlobalProtect App 6.0.7","GlobalProtect App 6.0.6","GlobalProtect App 6.0.5","GlobalProtect App 6.0.4","GlobalProtect App 6.0.3","GlobalProtect App 6.0.2","GlobalProtect App 6.0.1","GlobalProtect App 6.0.0","GlobalProtect App 6.0"],"x_cpeGeneratedAt":"2026-08-12T02:10:58.226Z","x_cpeManuallyEdited":true},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T03:55:53.877148Z","id":"CVE-2026-0298","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-13T13:20:48.963Z"}}]}}}