CVE-2026-0295: globalprotect 6.2.8, 6.3.3; +1 more affected products

Affected technology

globalprotect · before 6.0.15 (exclusive)
paloaltonetworks

globalprotect · from 6.2.0 (inclusive), before 6.2.8 (exclusive)
paloaltonetworks

globalprotect · from 6.3.0 (inclusive), before 6.3.3 (exclusive)
paloaltonetworks

globalprotect · 6.2.8
paloaltonetworks

globalprotect · 6.2.8 · update h1
paloaltonetworks

globalprotect · 6.2.8 · update h10
paloaltonetworks

globalprotect · 6.2.8 · update h11
paloaltonetworks

globalprotect · 6.2.8 · update h12
paloaltonetworks

globalprotect · 6.2.8 · update h2
paloaltonetworks

globalprotect · 6.2.8 · update h3
paloaltonetworks

globalprotect · 6.2.8 · update h4
paloaltonetworks

globalprotect · 6.2.8 · update h5
paloaltonetworks

globalprotect · 6.2.8 · update h6
paloaltonetworks

globalprotect · 6.2.8 · update h7
paloaltonetworks

globalprotect · 6.2.8 · update h8
paloaltonetworks

globalprotect · 6.2.8 · update h9
paloaltonetworks

globalprotect · 6.3.3
paloaltonetworks

globalprotect · 6.3.3 · update h1
paloaltonetworks

globalprotect · 6.3.3 · update h11
paloaltonetworks

globalprotect · 6.3.3 · update h12
paloaltonetworks

globalprotect · 6.3.3 · update h2
paloaltonetworks

globalprotect · 6.3.3 · update h3
paloaltonetworks

globalprotect · 6.3.3 · update h4
paloaltonetworks

globalprotect · 6.3.3 · update h6
paloaltonetworks

globalprotect · 6.3.3 · update h7
paloaltonetworks

globalprotect · 6.3.3 · update h8
paloaltonetworks

globalprotect · 6.3.3 · update h9
paloaltonetworks

GlobalProtect App · 6.3.0 to before 6.3.3-h14 (6.3.3-1121); status changes: 6.3.3-h14 — unaffected, 6.2.0 to before 6.2.8-h13 (6.2.8-1045); status changes: 6.2.8-h13 — unaffected, 6.0.0 to before 6.0.15; status changes: 6.0.15 — unaffected
Palo Alto Networks

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

A locally authenticated low-privileged attacker can escalate their privileges to root. Vendor/CNA’s CVSS 4.0 assessment (base score 4.1/10) rates confidentiality and integrity impact as high; availability impact as none.