CVE-2026-0314: GlobalProtect Windows app lets a local user crash it

What it is

The GlobalProtect app is Palo Alto Networks’ VPN client. The Windows version has a type confusion flaw (CWE-843). A local user with low privileges can use it to cause a denial of service.

The impact is availability only. The advisory lists no confidentiality or integrity impact, so this does not give an attacker code execution or higher privileges. The attacker needs to be logged in to the machine already. The practical risk is a user or malware crashing the VPN client on shared or multi-user Windows systems, such as terminal servers.

Palo Alto Networks rates it moderate (CVSS 4.3) and says it is not aware of any malicious exploitation. No public proof of concept was found. Credit goes to Artemy Tsetsersky and an internal researcher.

Am I affected?

You’re affected if a Windows endpoint runs a GlobalProtect app version below the fixed release for its branch. No special configuration is needed.

• 6.3: before 6.3.3-h16 (6.3.3-1199)
• 6.2: before 6.2.8-h15 (6.2.8-1084)
• 6.0: before 6.0.15

The Linux, macOS, iOS, Android and ChromeOS apps are not affected. The advisory says older unsupported versions should move to a supported fixed release.

The advisory does not describe a version check. Look at the installed GlobalProtect version on the Windows endpoint, or in your software inventory, and compare the full build number with the list above.

What to do

1. Update the GlobalProtect app on Windows endpoints to 6.3.3-h16, 6.2.8-h15 or 6.0.15 or later, depending on your branch.
2. There is no workaround. Palo Alto Networks lists upgrading as the only remedy.
3. Prioritise shared systems: multi-user Windows hosts, VDI and terminal servers, where one user can disrupt others. Because the impact is limited to availability and nothing is reported as exploited, this can follow your normal patch cycle rather than an emergency change.

Detection

Palo Alto Networks has not published indicators or detection guidance. The only expected symptom is the GlobalProtect client crashing or becoming unresponsive. Look in your endpoint inventory and EDR for repeated GlobalProtect process crashes on Windows hosts, especially ones triggered by non-admin users.