CVE-2026-0307
Received
Received - Intake
Local Privilege Escalation in Palo Alto GlobalProtect App
Vulnerability report for CVE-2026-0307, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-10
Last updated on: 2026-09-10
Assigner: Palo Alto Networks, Inc.
Description
Description
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
This GlobalProtect app on iOS, Android and ChromeOS is not impacted.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palo_alto_networks | globalprotect | 6.0 |
| palo_alto_networks | globalprotect | 6.2 |
| palo_alto_networks | globalprotect | 6.3 |
| palo_alto_networks | pan-os | 10.2 |
| palo_alto_networks | pan-os | 11.1 |
| palo_alto_networks | pan-os | 11.2 |
| palo_alto_networks | pan-os | 12.1 |
| palo_alto_networks | pan-os | 12.2 |
| palo_alto_networks | prisma_access | 10.2 |
| palo_alto_networks | prisma_access | 11.2 |
| palo_alto_networks | prisma_access | 12.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
