Description
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.

The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.
Published: 2026-05-13
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper certificate validation in the Palo Alto Networks GlobalProtect® App on Android, Chrome OS, and macOS. An attacker can exploit a local non‑administrative OS user or an adversary on the same subnet to intercept encrypted traffic, redirect it to an unauthorized server, and facilitate the installation of malicious software. The flaw compromises confidentiality and integrity, and the CWE indicates a failure to correctly validate certificates (CWE-295).

Affected Systems

Affected vendors/products are Palo Alto Networks GlobalProtect App on Android (6.1.0 through 6.1.12 and 6.0.0 through 6.0.13), Chrome OS (the same version ranges), and macOS (6.3.0 through 6.3.3-h8, 6.2.0 through 6.2.8-h9, and 6.0.0 through 6.0.12). Versions retrieved from the Advisory show an upgrade path to 6.1.13+, 6.0.14+, 6.3.3-h9 (or 6.3.3-999), and 6.2.8-h10 (or 6.2.8-948). The app on Linux, Windows, iOS, and UWP is not affected.

Risk and Exploitability

The CVSS score of 4.9 indicates medium severity. No EPSS information exists, and the vulnerability is not listed in CISA KEV. The likely attack vector involves a local or subnet‑level adversary who can install or manipulate the GlobalProtect App on a device, enabling traffic redirection and the delivery of malicious payloads. Because no workaround is available, the risk remains until the application is upgraded.

Generated by OpenCVE AI on May 13, 2026 at 20:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade every affected GlobalProtect App installation to the latest supported version—Android and Chrome OS to 6.1.13 or newer; macOS to 6.3.3-h9 (or 6.3.3-999) or newer, and 6.2.8-h10 (or 6.2.8-948) or newer.
  • Remove or disable legacy GlobalProtect packages from deployment channels and prevent end‑users from installing older versions on devices.
  • Enforce network segmentation and firewall rules that restrict internal traffic to the legitimate GlobalProtect VPN endpoints, and monitor for signs of TLS interception.

Generated by OpenCVE AI on May 13, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 15 May 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 13 May 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 13 May 2026 19:15:00 +0000

Type Values Removed Values Added
Description Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.
Title GlobalProtect App: Certificate Validation Bypass Vulnerabilities
First Time appeared Palo Alto Networks
Palo Alto Networks globalprotect App
Weaknesses CWE-295
CPEs cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Android:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:ChromeOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks globalprotect App
References
Metrics cvssV4_0

{'score': 4.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}

Subscriptions

Palo Alto Networks Globalprotect App
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-05-15T09:57:30.206Z

Reserved: 2025-11-03T20:44:09.928Z

Link: CVE-2026-0249

cve-icon Vulnrichment

Updated: 2026-05-13T19:31:25.892Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-13T19:16:59.073

Modified: 2026-05-14T16:21:23.190

Link: CVE-2026-0249

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-13T21:00:04Z

Weaknesses