GlobalProtect App
CVE-2026-0251: Local Privilege Escalation Vulnerabilities
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| GlobalProtect App (Windows) 6.3 | 6.3.3-h11 or later |
| GlobalProtect App (Windows) 6.2 | 6.2.8-h10 or later |
| GlobalProtect App (Windows) 6.0 | 6.0.13 or later |
| GlobalProtect App (macOS) 6.3 | 6.3.3-h11 or later |
| GlobalProtect App (macOS) 6.2 | 6.2.8-h10 or later |
| GlobalProtect App (macOS) 6.0 | 6.0.13 or later |
| GlobalProtect App (Linux) 6.3 | 6.3.3-h2 or later |
| GlobalProtect App (Linux) 6.0 | 6.0.11 or later |
| GlobalProtect App (Android, ChromeOS, iOS, UWP) | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of these issues.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.