CVE-2026-0298: globalprotect 6.0.15, 6.2.8, 6.3.3; +1 more affected products

Affected technology

globalprotect · from 6.0.0 (inclusive), before 6.0.15 (exclusive)
paloaltonetworks

globalprotect · from 6.2.0 (inclusive), before 6.2.8 (exclusive)
paloaltonetworks

globalprotect · from 6.3.0 (inclusive), before 6.3.3 (exclusive)
paloaltonetworks

globalprotect · 6.0.15
paloaltonetworks

globalprotect · 6.2.8
paloaltonetworks

globalprotect · 6.2.8 · update h10
paloaltonetworks

globalprotect · 6.2.8 · update h11
paloaltonetworks

globalprotect · 6.2.8 · update h12
paloaltonetworks

globalprotect · 6.2.8 · update h2
paloaltonetworks

globalprotect · 6.2.8 · update h3
paloaltonetworks

globalprotect · 6.2.8 · update h4
paloaltonetworks

globalprotect · 6.2.8 · update h5
paloaltonetworks

globalprotect · 6.2.8 · update h6
paloaltonetworks

globalprotect · 6.2.8 · update h7
paloaltonetworks

globalprotect · 6.2.8 · update h8
paloaltonetworks

globalprotect · 6.2.8 · update h9
paloaltonetworks

globalprotect · 6.3.3
paloaltonetworks

globalprotect · 6.3.3 · update h1
paloaltonetworks

globalprotect · 6.3.3 · update h11
paloaltonetworks

globalprotect · 6.3.3 · update h12
paloaltonetworks

globalprotect · 6.3.3 · update h2
paloaltonetworks

globalprotect · 6.3.3 · update h3
paloaltonetworks

globalprotect · 6.3.3 · update h4
paloaltonetworks

globalprotect · 6.3.3 · update h6
paloaltonetworks

globalprotect · 6.3.3 · update h7
paloaltonetworks

globalprotect · 6.3.3 · update h8
paloaltonetworks

globalprotect · 6.3.3 · update h9
paloaltonetworks

GlobalProtect App · 6.3.0 to before 6.3.3-h14; status changes: 6.3.3-h14 — unaffected, 6.2.0 to before 6.2.8-h13; status changes: 6.2.8-h13 — unaffected, 6.0.0 to before 6.0.15; status changes: 6.0.15 — unaffected
Palo Alto Networks

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

A man-in-the-middle (MitM) attacker can execute arbitrary code with SYSTEM privileges on an affected client. Vendor/CNA’s CVSS 4.0 assessment (base score 5.2/10) rates confidentiality, integrity and availability impact as high.