GlobalProtect App
CVE-2026-0250: Buffer Overflow Vulnerability during connection to Portal or Gateway
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| GlobalProtect App (Windows, macOS) 6.3 | 6.3.3-h9 or later |
| GlobalProtect App (Windows, macOS) 6.2 | 6.2.8-h10 or later |
| GlobalProtect App (Android, ChromeOS) 6.1 | 6.1.14 or later |
| GlobalProtect App (Android, ChromeOS) 6.3 | 6.3.5 or later |
| GlobalProtect App (Linux) 6.3 | 6.3.3-h15 or later |
| GlobalProtect App (Linux) 6.0 | 6.0.15 or later |
| GlobalProtect App (Windows, macOS) 6.0 | 6.0.13 or later |
| GlobalProtect App (Android, ChromeOS) 6.0 | 6.0.15 or later |
| GlobalProtect UWP App (Windows) 6.3 | 6.3.3-h10 or later |
| GlobalProtect App (iOS) | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway.
The GlobalProtect app on iOS is not affected.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.