GlobalProtect App
CVE-2026-0315: Local Privilege Escalation Vulnerability on macOS
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| GlobalProtect App (macOS) 6.2 | 6.2.8-h15 or later |
| GlobalProtect App (macOS) 6.3 | 6.3.3-h16 or later |
| GlobalProtect App (Linux, Windows, iOS, Android, ChromeOS) | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
A local privilege escalation flaw in the GlobalProtect app on macOS allows a low-privileged user to gain root access without user interaction. An attacker with local access can exploit this to execute arbitrary commands with administrative privileges.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.