GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
Summary
| CVE | CVE-2026-0315 |
|---|---|
| State | PUBLISHED |
| Assigner | palo_alto |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 21:17:18 UTC |
| Updated | 2026-10-16 04:18:05 UTC |
| Description | A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability. |
Risk And Classification
Primary CVSS: v4.0 5.9 MEDIUM from [email protected]
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Problem Types: CWE-426 | CWE-426 CWE-426 Untrusted Search Path
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/C... |
| 4.0 | CNA | CVSS | 5.9 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/A... |
CVSS v4.0 Breakdown
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Palo Alto Networks | GlobalProtect App | affected 6.2.0 6.2.8-h15 custom | macOS |
| CNA | Palo Alto Networks | GlobalProtect App | affected 6.3.0 6.3.3-h16 custom | macOS |
| CNA | Palo Alto Networks | GlobalProtect App | unaffected All 12.2.4 custom | Linux, Windows, iOS, Android, ChromeOS |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.paloaltonetworks.com/CVE-2026-0315 | [email protected] | security.paloaltonetworks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Ronen Seleri and Shahaf Pruss of Blyde Labs (en)
CNA: Christopher Ellis of Workday (en)
CNA: James Otten (internal reporter) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-14T16:00:00.000Z | Initial Publication. |
Solutions
CNA: Version Minor VersionSuggested SolutionGlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h15Upgrade to 6.3.3-h16 (6.3.3-1199) or later.GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h14 Upgrade to 6.2.8-h15 (6.2.8-1084) or later.GlobalProtect App on Linux No action needed.GlobalProtect App on Windows No action needed.GlobalProtect App on iOS No action needed.GlobalProtect App on Android No action needed.GlobalProtect App on ChromeOS No action needed.
Workarounds
CNA: No known workarounds exist for this issue.
Exploits
CNA: Palo Alto Networks is not aware of any malicious exploitation of this issue.