CVE-2026-0307

Awaiting Analysis Awaiting Analysis - Queue

Local Privilege Escalation in Palo Alto GlobalProtect App

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: Palo Alto Networks, Inc.

Description

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-0307

EUVD

EUVD-2026-75257

Affected Vendors & Products

Vendor	Product	Version / Range
palo_alto_networks	globalprotect	6.0
palo_alto_networks	globalprotect	6.2
palo_alto_networks	globalprotect	6.3
palo_alto_networks	pan-os	10.2
palo_alto_networks	pan-os	11.1
palo_alto_networks	pan-os	11.2
palo_alto_networks	pan-os	12.1
palo_alto_networks	pan-os	12.2
palo_alto_networks	prisma_access	10.2
palo_alto_networks	prisma_access	11.2
palo_alto_networks	prisma_access	12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

This is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app. It allows a non-administrative local user to gain elevated privileges to NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux. This enables execution of arbitrary commands with administrative privileges.

Detection Guidance

To detect this vulnerability, check the installed version of the GlobalProtect app against affected versions (6.0, 6.2, 6.3) on Windows, macOS, or Linux. Verify PAN-OS versions (10.2, 11.1, 11.2, 12.1, 12.2) and Prisma Access versions (10.2, 11.2, 12.1). No specific commands are provided in the context.

Impact Analysis

A non-admin user could exploit this to gain full control over a system, install malware, access sensitive data, or perform unauthorized actions. It requires local access but no user interaction beyond initial exploitation.

Compliance Impact

This vulnerability allows non-administrative users to gain administrative privileges, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR and HIPAA that mandate strict access controls and protection of personal or health information.

Mitigation Strategies

Upgrade the GlobalProtect app to a patched version and update PAN-OS or Prisma Access to the latest versions. No workarounds are available. Failure to update exposes systems to local privilege escalation risks.

Hi! I’m here to help you understand CVE-2026-0307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70