CVE-2026-0297 is a buffer overflow in the Palo Alto Networks GlobalProtect app. The record scores it 8.1 (High); the vendor rates it Medium (5.2). A man-in-the-middle attacker or rogue gateway could run code as SYSTEM or root. Update to the fixed app builds below, or move tunnels to SSL only.
What's affected
The weakness is CWE-787 (out-of-bounds write). Palo Alto Networks titles the advisory "GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake". No special configuration is needed to be affected.
Severity differs by source. The NVD record lists CVSS 3.1 base score 8.1 (High) with a network attack vector and high attack complexity. The vendor advisory instead lists CVSS-BT 5.2 (Medium) and CVSS-B 7.7 on the CVSS 4.0 scale, with an adjacent attack vector and a suggested urgency of Moderate. Both agree the impact on confidentiality, integrity and availability is high if the attack works.
Affected and fixed builds, per the vendor page when we reviewed it:
- GlobalProtect 6.3 on Windows and macOS: versions before 6.3.3-h14 are affected. Fixed in 6.3.3-h14.
- GlobalProtect 6.3 on Linux: versions before 6.3.3-h15 are affected. Fixed in 6.3.3-h15, listed with an ETA of 17 September.
- GlobalProtect 6.2 on Windows and macOS: versions before 6.2.8-h13 are affected. Fixed in 6.2.8-h13. All 6.2 Linux builds are listed as affected with no fix.
- GlobalProtect 6.0 on all platforms: versions before 6.0.15 are affected. 6.0.15 is listed with an ETA of 29 October.
- GlobalProtect 6.1 through 6.3.4 on iOS, Android and Chrome OS: upgrade to 6.3.5 or later.
Because the ETAs may have moved, confirm that a fixed build is actually downloadable before you plan the rollout.
How to check if you're exposed
Start with an inventory of GlobalProtect clients. On a managed Windows or macOS fleet, your endpoint management tool already knows the installed app version. Compare it against the table above.
On a single machine, open the GlobalProtect app, go to Settings, then About, to see the build. The same version string appears in the installed programs list on Windows.
Then check how your tunnels are configured. The exposed path is the UDP tunnel handshake, which belongs to IPSec mode. In the GlobalProtect portal agent configuration, look at the Advanced Control for Tunnel Mode Behavior setting. On the gateway, look at whether Enable IPSec is ticked under Network, Gateway, Agent, Tunnel Settings. If IPSec is off and clients can only use SSL, the handshake path is not in use.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Inventory every GlobalProtect client and note the version and operating system.
- Upgrade to the fixed build for your release train: 6.3.3-h14 (Windows, macOS), 6.3.3-h15 (Linux), 6.2.8-h13 (Windows, macOS), 6.0.15 (all), or 6.3.5 (iOS, Android, Chrome OS).
- Where you cannot upgrade yet, apply the vendor workaround: disable IPSec and UDP tunneling on the portal and gateway so clients connect over SSL only. The advisory describes the exact portal and gateway settings, and notes a separate step for newer app versions.
- Plan around the Linux 6.2 gap. The advisory lists all 6.2 Linux builds as affected with no fix, so move those clients to a fixed 6.3 build.
- Re-check the advisory before and after the rollout, since fix dates were still listed as ETAs.
Why it matters
Client VPN software runs with high privileges and parses data from the network before the user has done anything. A memory error in that parsing code is a serious thing even when the attacker must sit on the path between the laptop and the gateway. That position is realistic on hotel, airport and shared office networks.
The vendor says it is not aware of malicious exploitation, and the record does not mark this CVE as known exploited. The advisory says the issue was found internally. That lowers urgency for most teams, but it does not remove the need to patch, because the fix path for Linux and the older 6.0 train is still in motion.
Quick check
Why do the record and the vendor give different scores?
The record carries a CVSS 3.1 score of 8.1. The vendor page reports CVSS 4.0 scores: 5.2 with threat metrics and 7.7 base. Different scoring versions weigh attack requirements differently. Use the vendor page for patch planning and treat the higher figure as the worst case.
Does switching to SSL only fully remove the risk?
The vendor lists it as a mitigation for this issue, not a fix. The advisory offers three mitigation options. Read them in full and still plan to upgrade.
Sources
Last reviewed: 18 October 2026.
