CVE-2026-0251
HIGHGlobalProtect App: Local Privilege Escalation Vulnerabilities
Title source: cnaDescription
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
https://security.paloaltonetworks.com/CVE-2026-0251
Scores
CVSS v3
7.8
EPSS
0.0015
EPSS Percentile
4.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-426
Status
published
Products (10)
Palo Alto Networks/Global Protect App
All
Palo Alto Networks/GlobalProtect App
6.0.0 - 6.0.11
Palo Alto Networks/GlobalProtect App
6.0.0 - 6.0.13
Palo Alto Networks/GlobalProtect App
6.2.0 - 6.2.8-h10 (6.2.8-948)
Palo Alto Networks/GlobalProtect App
6.3.0 - 6.3.3-h2 (6.3.3-42)
Palo Alto Networks/GlobalProtect App
6.3.0 - 6.3.3-h9 (6.3.3-999)
paloaltonetworks/globalprotect
6.2.8 (5 CPE variants)
paloaltonetworks/globalprotect
6.3.3 (20 CPE variants)
paloaltonetworks/globalprotect
6.0.0 - 6.0.11
paloaltonetworks/globalprotect
6.0.0 - 6.0.13 (2 CPE variants)
Published
May 13, 2026
Tracked Since
May 14, 2026