CVE-2026-0298 is an input validation flaw in the Windows Pre-Logon Access Provider component of the Palo Alto Networks GlobalProtect app. The record scores it 8.1 (High); the vendor says 5.2 (Medium). A man-in-the-middle attacker could run code as SYSTEM. Upgrade Windows clients, or stop using SAML with Connect Before Logon.
What's affected
Only the GlobalProtect app on Windows is affected. The record and the vendor both say Linux, macOS, iOS, Android and Chrome OS are not affected.
The vendor adds a condition: the issue applies only to devices configured to use SAML authentication in the GlobalProtect Connect Before Logon feature. If you do not use Connect Before Logon with SAML, you are outside the stated exposure.
Affected and fixed Windows builds, from the vendor page:
- 6.3 train: versions before 6.3.3-h14 (6.3.3-1121). Fixed in 6.3.3-h14 (6.3.3-1121).
- 6.2 train: versions before 6.2.8-h13 (6.2.8-1045). Fixed in 6.2.8-h13 (6.2.8-1045).
- 6.0 train: versions before 6.0.15. 6.0.15 was listed with an ETA of 29 October.
The weakness is CWE-94 (code injection). On severity, the record lists CVSS 3.1 score 8.1 (High, network vector, high complexity). The vendor lists CVSS-BT 5.2 and CVSS-B 7.7 on CVSS 4.0, with an adjacent attack vector, and calls it Medium with Moderate urgency. Both are shown here so you can decide how fast to move.
How to check if you're exposed
Two questions decide whether you are exposed: which Windows build is installed, and whether the pre-logon path uses SAML.
For the build, check the GlobalProtect app version on a sample machine, or pull the installed version from your endpoint management inventory. On a Windows machine you can also read it from the installed programs list.
For the configuration, review the GlobalProtect portal agent settings for Connect Before Logon and the authentication profile attached to it. If the profile uses SAML, the device matches the vendor's required configuration. If you rely on pre-logon with a machine certificate instead, the advisory points to that as a mitigation.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- List all Windows devices running GlobalProtect and their build numbers.
- Upgrade to 6.3.3-h14, 6.2.8-h13 or 6.0.15 depending on your train. Confirm the 6.0.15 build is available before relying on it.
- If you cannot upgrade soon, apply a vendor mitigation: use Connect Before Logon without SAML authentication, or use pre-logon with a machine certificate in place of Connect Before Logon.
- Leave non-Windows clients alone for this CVE. The vendor says no action is needed for them.
- Record the change so the next audit can show which clients were on which build.
Why it matters
The pre-logon component runs before a user signs in, and it runs as SYSTEM. If input from the network is not validated there, the attacker gets the highest local privilege on the machine without needing an account on it. That is why a vendor-rated Medium issue is still worth a planned fix.
The attack needs a position between the client and the gateway or identity flow. The vendor says it is not aware of malicious exploitation, and the record does not flag the CVE as known exploited. It was found by the vendor's own research teams.
Quick check
Are macOS and Linux clients affected by CVE-2026-0298?
No. The record and the vendor advisory say only the Windows app is affected, and the vendor lists no action for the other platforms.
I use Connect Before Logon without SAML. Am I exposed?
The vendor says the issue applies only to devices configured to use SAML authentication in Connect Before Logon. That configuration is also the vendor workaround. Patching is still sensible.
Sources
Last reviewed: 18 October 2026.
