CVE-2026-0299: High Local Privilege Escalation in GlobalProtect

CVE-2026-0299 is a local privilege escalation in the Palo Alto Networks GlobalProtect app on Windows, macOS and Linux. The record scores it 7.8 (High); the vendor says 5.9 (Medium). A non-administrative user could run commands as SYSTEM or root. Upgrade to the fixed builds; the vendor lists no workaround.

What's affected

The weakness is CWE-426 (untrusted search path). The record says the app on iOS, Android and Chrome OS is not affected. Windows, macOS and Linux clients are. No special configuration is needed to be affected.

Fixed builds from the vendor page:

• 6.3 train: Windows and macOS fixed in 6.3.3-h14 (6.3.3-1121); Linux fixed in 6.3.3-h15, listed with an ETA of 17 September.
• 6.2 train: Windows and macOS fixed in 6.2.8-h13 (6.2.8-1045). All 6.2 Linux builds are listed as affected with no fixed build, so Linux users on 6.2 need to move to a 6.3 build.
• 6.0 train: fixed in 6.0.15 on Windows, macOS and Linux, listed with an ETA of 29 October.

On severity, the record has CVSS 3.1 7.8 (High, local vector, low privileges). The vendor uses CVSS 4.0 and lists CVSS-BT 5.9 and CVSS-B 8.5, calling it Medium with Moderate urgency. The vendor says it is not aware of malicious exploitation, and the record does not flag it as known exploited.

How to check if you're exposed

This is a local issue, so the question is who can log on to your endpoints. Shared machines, virtual desktops and developer laptops with several users deserve attention first.

Check the installed version. In the GlobalProtect app, open Settings and About. On Windows, the installed programs list shows the same value. On macOS and Linux, your device management inventory or package listing will report it. Compare each result with the fixed builds above.

There is nothing to switch off, because the vendor says no workaround exists. The version number is the whole test.

The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.

What to do now

1. Inventory GlobalProtect clients on Windows, macOS and Linux with their versions.
2. Upgrade to 6.3.3-h14 or 6.3.3-h15, 6.2.8-h13 (Windows and macOS only) or 6.0.15, or a later release on your train.
3. Move Linux clients on 6.2 to a fixed 6.3 build, since no 6.2 Linux fix is listed.
4. Prioritise multi-user and shared systems, where a low-privileged account is easiest to come by.
5. Re-read the vendor advisory before you finish, because several fix dates were shown as ETAs.

Why it matters

Privilege escalation bugs matter most as the second step in a longer attack. An attacker who already has a foothold as an ordinary user, through phishing or a stolen password, can use a flaw like this to take over the machine and reach its VPN credentials and stored secrets.

An untrusted search path means a privileged program may load code from a place a lower-privileged user can write to. The fix is to make the program look only where it should. Because this app runs with high privilege on every platform it supports, getting the version right across the fleet is the control that matters.

Quick check

Sources

• Palo Alto Networks advisory CVE-2026-0299

Last reviewed: 18 October 2026.