CVE-2026-0315: medium-severity vulnerability in Palo Alto Networks GlobalProtect App
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.1%
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Affected products
Palo Alto Networks · GlobalProtect AppRelated CVEs — Palo Alto Networks GlobalProtect App
In the same product, most dangerous first.
CVE-2024-5921MEDIUMGlobalProtect App: Insufficient Certificate Validation Leads to Privilege EscalationEPSS 1.5%CVE-2021-3057HIGHGlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or GatewayEPSS 1.4%CVE-2020-2033MEDIUMGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookieEPSS 0.9%CVE-2022-0018MEDIUMGlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On EnabledEPSS 0.7%CVE-2026-0298MEDIUMGlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)EPSS 0.7%CVE-2026-0297MEDIUMGlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel HandshakeEPSS 0.6%