Description
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Published: 2026-10-14
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local privilege escalation to root on macOS
Action: Immediate Patch
AI Analysis

Impact

A local attacker who has a non‑administrative account can exploit the GlobalProtect app on macOS to gain root privileges, allowing arbitrary command execution with administrative rights. The vulnerability is a privilege escalation flaw that permits full system compromise by local users, but does not affect remote threat vectors or other operating systems.

Affected Systems

The fault affects Palo Alto Networks GlobalProtect App on macOS, specifically versions 6.2.0 through 6.2.8-h14 and 6.3.0 through 6.3.3-h15. Only macOS installations are impacted; GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS are not vulnerable.

Risk and Exploitability

With a CVSS score of 5.9, the vulnerability is of moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires local presence on the target machine; no remote execution path is described. The lack of a workaround means that the only mitigation is to apply the vendor’s patch or install a newer app version.

Generated by OpenCVE AI on October 15, 2026 at 12:46 UTC.

Remediation

Vendor Workaround

No known workarounds exist for this issue.

OpenCVE Recommended Actions

  • Upgrade macOS GlobalProtect App to version 6.3.3-h16 (6.3.3-1199) or later, or to 6.2.8-h15 (6.2.8-1084) or later, following the vendor’s upgrade path.
  • Remove or disable any older vulnerable GlobalProtect App installations from macOS systems.
  • Limit local non‑administrative user access to the GlobalProtect installer, configuration directories, or execution paths to reduce the chance of exploitation if an upgrade cannot be performed immediately.

Generated by OpenCVE AI on October 15, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Title GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
First Time appeared Palo Alto Networks
Palo Alto Networks globalprotect App
Weaknesses CWE-426
CPEs cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks globalprotect App
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}

Subscriptions

Palo Alto Networks Globalprotect App
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-10-15T18:31:39.815Z

Reserved: 2025-11-03T20:45:13.819Z

Link: CVE-2026-0315

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T21:17:18.517

Modified: 2026-10-15T16:26:48.877

Link: CVE-2026-0315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T13:00:18Z

Weaknesses