CVE-2026-0296 is an improper certificate validation flaw in the Palo Alto Networks GlobalProtect app. It lets an attacker with man-in-the-middle access intercept and change application traffic. The record scores it 7.4 high; the vendor rates it medium (4.5).
What's affected
Per the vendor advisory, GlobalProtect on Windows, macOS and Linux is affected. iOS, Android and Chrome OS are not. The advisory says VPN tunnel traffic is not impacted, and that no special configuration is needed to be exposed. Fixed builds:
- 6.3 branch: Windows and macOS 6.3.3-h14 (6.3.3-1121) or later, Linux 6.3.3-h15 or later.
- 6.2 branch: Windows and macOS 6.2.8-h13 (6.2.8-1045) or later. On Linux, the advisory lists all 6.2 builds as affected and points to 6.3.3-h15 or later.
- 6.0 branch: 6.0.15 or later on all three platforms.
The advisory listed estimated dates for some builds when it was updated: 09/17 for Linux 6.3.3-h15 and 10/29 for the 6.0.15 builds. Confirm availability in the vendor portal.
The record and the vendor disagree on severity and on attack vector, so here are both.
- Record (NVD data): CVSS 3.1 base score 7.4, high, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The attack vector is network and complexity is high.
- Vendor advisory: severity medium, urgency moderate. CVSS 4.0 base (CVSS-B) 7.4 and with threat metrics (CVSS-BT) 4.5. Its attack vector is adjacent, with user interaction passive, and exploit maturity unreported.
The vendor says it is not aware of any malicious exploitation, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. The vendor discovered it internally. It was first published on 12 August 2026 and updated on 12 September 2026; the record's published date is 13 August 2026.
How to check if you're exposed
Open the GlobalProtect app on each endpoint and read the version from its settings or About page. In a managed fleet, query your endpoint tool for the installed version on Windows, macOS and Linux devices.
Match the version against your branch above. Any build below the listed fixed build on those three platforms is affected. The advisory's attack vector tells you the main risk sits on untrusted networks such as public Wi-Fi, where someone can sit between the client and the service.
What to do now
- Inventory GlobalProtect clients on Windows, macOS and Linux with their branch and build.
- Upgrade to the fixed build for each branch, or move to a newer branch.
- The advisory states that no workarounds or mitigations exist, so upgrading is the only control.
- Until upgrades finish, advise staff to avoid connecting from untrusted public networks without another protective layer.
- Record the rollout in your asset inventory so you can show which devices are done.
Why it matters
The weakness is CWE-295, improper certificate validation. A client that does not check properly who it is talking to can be handed a stand-in server by anyone positioned on the network path. That person can then read and alter the application's own communications. The advisory states that traffic inside the VPN tunnel is not impacted, so the exposure is the app's own connections, not the tunnel itself.
Certificate checks are the basis of trust on the network. When they fail, encryption still happens but it protects the wrong conversation.
Quick check
Is my VPN tunnel traffic exposed?
The vendor says VPN tunnel traffic is not impacted. The flaw concerns the app's own application communications, so patch the client all the same.
Is the attack vector network or adjacent?
The record's CVSS 3.1 vector says network. The vendor's CVSS 4.0 vector says adjacent. Both agree the attacker needs a position on the network path between client and server.
Sources
- Palo Alto Networks advisory for CVE-2026-0296
- Gold vulnerability page
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
