GlobalProtect App
CVE-2026-0296: Improper Certificate Validation Bypass Vulnerability
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| GlobalProtect App (Linux) 6.3 | 6.3.3-h15 or later |
| GlobalProtect App (Linux) 6.2 | See the advisory |
| GlobalProtect App (Linux) 6.0 | 6.0.15 or later |
| GlobalProtect App (macOS, Windows) 6.3 | 6.3.3-h14 or later |
| GlobalProtect App (macOS, Windows) 6.2 | 6.2.8-h13 or later |
| GlobalProtect App (macOS, Windows) 6.0 | 6.0.15 or later |
| GlobalProtect App (iOS, Android, Chrome OS) | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds or mitigations exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.