CVE-2026-0295 is a race condition in the Palo Alto Networks GlobalProtect app on macOS that lets a low privileged local user reach root. The record scores it 7.0 high; the vendor rates it medium (4.1). Upgrade to 6.3.3-h14, 6.2.8-h13 or 6.0.15.
What's affected
Per the vendor advisory, only GlobalProtect on macOS is affected. Linux, Windows, iOS, Android and Chrome OS are not. No special configuration is needed to be exposed. The affected and fixed versions are:
- GlobalProtect 6.3 on macOS, 6.3.0 through 6.3.3-h13: upgrade to 6.3.3-h14 (6.3.3-1121) or later.
- GlobalProtect 6.2 on macOS, 6.2.0 through 6.2.8-h12: upgrade to 6.2.8-h13 (6.2.8-1045) or later.
- GlobalProtect 6.0 on macOS, 6.0.0 through 6.0.14: upgrade to 6.0.15 or later. The advisory listed an ETA of 10/29 for 6.0.15, so confirm it is available before planning around it.
The record and the vendor disagree on severity, so here are both.
- Record (NVD data): CVSS 3.1 base score 7.0, high, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Attack complexity is high in this vector.
- Vendor advisory: severity medium, urgency moderate. CVSS 4.0 base (CVSS-B) 7.2 and with threat metrics (CVSS-BT) 4.1, exploit maturity unreported.
The vendor says it is not aware of any malicious exploitation. The CVE is not in the CISA Known Exploited Vulnerabilities catalog. The vendor page was updated on 12 September 2026 and first published on 12 August 2026; the record's published date is 13 August 2026.
How to check if you're exposed
On a Mac, open the GlobalProtect app, go to the settings or About view, and read the version. You can also ask your device management tool for the installed GlobalProtect version across all macOS endpoints.
Compare it against the three branches above. Only macOS clients on a version below the fixed build for their branch are affected.
What to do now
- List every Mac that runs GlobalProtect and note the branch and build.
- Move each to the fixed build for its branch: 6.3.3-h14, 6.2.8-h13 or 6.0.15, or a later release.
- The advisory says there are no known workarounds or mitigations, so patching is the only control.
- Limit which users have a local login on shared Macs, since the attacker needs a local, low privileged account.
- Keep your endpoint detection tooling reporting on privilege changes and unexpected root processes.
Why it matters
The weakness is CWE-362, a race condition from concurrent use of a shared resource without proper synchronisation. The vendor classifies it as a time-of-check to time-of-use problem: something is checked, then used, and an attacker with local access changes it in between. Timing makes it harder to pull off, which is why the record's vector marks attack complexity as high.
Local escalation bugs matter because they turn a small foothold into full control of the Mac. On a laptop that holds VPN credentials, root access is a serious step.
Quick check
Does this affect GlobalProtect on Windows?
Not according to the vendor. This CVE is limited to macOS. Windows is affected by a different GlobalProtect issue, CVE-2026-0296, which is about certificate validation.
Why do the High and Medium ratings differ?
The record uses CVSS 3.1 and scores 7.0. The vendor uses CVSS 4.0 with a threat metric that reflects no reported exploitation, which gives 4.1. Patch on the vendor timeline.
Sources
- Palo Alto Networks advisory for CVE-2026-0295
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
