CVE-2026-0307

published 2026-09-10

CVE-2026-0307: Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT…

Priority P3 35 medium 5.9 CVSS 4.0

AV L AC L AT N PR L UI N VC H VI H VA H SC L SI L SA L E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V D RE M U Amber

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
palo_alto_networks	globalprotect_app	—	—
palo_alto_networks	globalprotect_app	>= 6.0.0 < 6.0.15	6.0.15
palo_alto_networks	globalprotect_app	>= 6.2.0 < 6.2.8-h14	6.2.8-h14
palo_alto_networks	globalprotect_app	>= 6.3.0 < 6.3.3-h15	6.3.3-h15
paloalto	globalprotect_app	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-426