CVE-2026-0296: globalprotect 6.2.8, 6.3.3; +1 more affected products

Affected technology

globalprotect · from 6.0.0 (inclusive), before 6.0.15 (exclusive)
paloaltonetworks

globalprotect · from 6.2.0 (inclusive), before 6.2.8 (exclusive)
paloaltonetworks

globalprotect · from 6.2.0 (inclusive), through 6.2.9 (inclusive)
paloaltonetworks

globalprotect · from 6.3.0 (inclusive), before 6.3.3 (exclusive)
paloaltonetworks

globalprotect · Version not applicable in the source CPE
paloaltonetworks

globalprotect · 6.2.8
paloaltonetworks

globalprotect · 6.2.8 · update h1
paloaltonetworks

globalprotect · 6.2.8 · update h10
paloaltonetworks

globalprotect · 6.2.8 · update h11
paloaltonetworks

globalprotect · 6.2.8 · update h12
paloaltonetworks

globalprotect · 6.2.8 · update h2
paloaltonetworks

globalprotect · 6.2.8 · update h3
paloaltonetworks

globalprotect · 6.2.8 · update h4
paloaltonetworks

globalprotect · 6.2.8 · update h5
paloaltonetworks

globalprotect · 6.2.8 · update h6
paloaltonetworks

globalprotect · 6.2.8 · update h7
paloaltonetworks

globalprotect · 6.2.8 · update h8
paloaltonetworks

globalprotect · 6.2.8 · update h9
paloaltonetworks

globalprotect · 6.3.3
paloaltonetworks

globalprotect · 6.3.3 · update h1
paloaltonetworks

globalprotect · 6.3.3 · update h11
paloaltonetworks

globalprotect · 6.3.3 · update h12
paloaltonetworks

globalprotect · 6.3.3 · update h2
paloaltonetworks

globalprotect · 6.3.3 · update h3
paloaltonetworks

globalprotect · 6.3.3 · update h4
paloaltonetworks

globalprotect · 6.3.3 · update h6
paloaltonetworks

globalprotect · 6.3.3 · update h7
paloaltonetworks

globalprotect · 6.3.3 · update h8
paloaltonetworks

globalprotect · 6.3.3 · update h9
paloaltonetworks

GlobalProtect App · 6.3.0 to before 6.3.3-h15; status changes: 6.3.3-h15 — unaffected, 6.2.0, 6.0.0 to before 6.0.15; status changes: 6.0.15 — unaffected
Palo Alto Networks

GlobalProtect App · 6.3.0 to before 6.3.3-h14; status changes: 6.3.3-h14 — unaffected, 6.2.0 to before 6.2.8-h13; status changes: 6.2.8-h13 — unaffected, 6.0.0 to before 6.0.15; status changes: 6.0.15 — unaffected
Palo Alto Networks

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · Passive user interaction

What an attacker can do

An unauthenticated attacker with man-in-the-middle (MitM) access can intercept and modify application communications. Vendor/CNA’s CVSS 4.0 assessment (base score 4.5/10) rates confidentiality and integrity impact as high; availability impact as none.