{"api_version":"1","generated_at":"2026-10-21T12:45:43+00:00","cve":"CVE-2026-0315","urls":{"html":"https://cve.report/CVE-2026-0315","api":"https://cve.report/api/cve/CVE-2026-0315.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-0315","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-0315"},"summary":{"title":"GlobalProtect App: Local Privilege Escalation Vulnerability on macOS","description":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.","state":"PUBLISHED","assigner":"palo_alto","published_at":"2026-10-14 21:17:18","updated_at":"2026-10-16 04:18:05"},"problem_types":["CWE-426","CWE-426 CWE-426 Untrusted Search Path"],"metrics":[{"version":"4.0","source":"psirt@paloaltonetworks.com","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"5.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","data":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":5.9,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"}}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0315","name":"https://security.paloaltonetworks.com/CVE-2026-0315","refsource":"psirt@paloaltonetworks.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0315","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0315","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Palo Alto Networks","product":"GlobalProtect App","version":"affected 6.2.0 6.2.8-h15 custom","platforms":["macOS"]},{"source":"CNA","vendor":"Palo Alto Networks","product":"GlobalProtect App","version":"affected 6.3.0 6.3.3-h16 custom","platforms":["macOS"]},{"source":"CNA","vendor":"Palo Alto Networks","product":"GlobalProtect App","version":"unaffected All 12.2.4 custom","platforms":["Linux","Windows","iOS","Android","ChromeOS"]}],"timeline":[{"source":"CNA","time":"2026-10-14T16:00:00.000Z","lang":"en","value":"Initial Publication."}],"solutions":[{"source":"CNA","title":"","value":"Version Minor VersionSuggested SolutionGlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h15Upgrade to 6.3.3-h16 (6.3.3-1199) or later.GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h14\nUpgrade to 6.2.8-h15 (6.2.8-1084) or later.GlobalProtect App on Linux \n No action needed.GlobalProtect App on Windows No action needed.GlobalProtect App on iOS No action needed.GlobalProtect App on Android No action needed.GlobalProtect App on ChromeOS No action needed.","time":"","lang":"eng"}],"workarounds":[{"source":"CNA","title":"","value":"No known workarounds exist for this issue.","time":"","lang":"en"}],"exploits":[{"source":"CNA","title":"","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.","time":"","lang":"en"}],"credits":[{"source":"CNA","value":"Ronen Seleri and Shahaf Pruss of Blyde Labs","lang":"en"},{"source":"CNA","value":"Christopher Ellis of Workday","lang":"en"},{"source":"CNA","value":"James Otten (internal reporter)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-0315","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-16T03:56:58.518Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*","cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*"],"defaultStatus":"unaffected","platforms":["macOS"],"product":"GlobalProtect App","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"6.2.8-h15","status":"unaffected"}],"lessThan":"6.2.8-h15","status":"affected","version":"6.2.0","versionType":"custom"},{"changes":[{"at":"6.3.3-h16","status":"unaffected"}],"lessThan":"6.3.3-h16","status":"affected","version":"6.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux","Windows","iOS","Android","ChromeOS"],"product":"GlobalProtect App","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"12.2.4","status":"unaffected"}],"lessThan":"12.2.4","status":"unaffected","version":"All","versionType":"custom"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No special configuration is required to be affected by this issue."}],"value":"No special configuration is required to be affected by this issue."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*","versionEndExcluding":"6.2.8-h15","versionStartIncluding":"6.2.8","vulnerable":true},{"criteria":"cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*","versionEndExcluding":"6.3.3-h16","versionStartIncluding":"6.3.3","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Ronen Seleri and Shahaf Pruss of Blyde Labs"},{"lang":"en","type":"finder","value":"Christopher Ellis of Workday"},{"lang":"en","type":"finder","value":"James Otten (internal reporter)"}],"datePublic":"2026-10-14T16:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability."}],"value":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":5.9,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-426","description":"CWE-426 Untrusted Search Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-14T20:24:21.191Z","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","shortName":"palo_alto"},"references":[{"name":"PAN-OS Security Advisory","tags":["vendor-advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0315"}],"solutions":[{"lang":"eng","supportingMedia":[{"base64":false,"type":"text/html","value":"
Version Minor VersionSuggested Solution
GlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h15Upgrade to 6.3.3-h16 (6.3.3-1199) or later.
GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h14
Upgrade to 6.2.8-h15 (6.2.8-1084) or later.
GlobalProtect App on Linux
 No action needed.
GlobalProtect App on Windows No action needed.
GlobalProtect App on iOS No action needed.
GlobalProtect App on Android No action needed.
GlobalProtect App on ChromeOS No action needed.
"}],"value":"Version Minor VersionSuggested SolutionGlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h15Upgrade to 6.3.3-h16 (6.3.3-1199) or later.GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h14\nUpgrade to 6.2.8-h15 (6.2.8-1084) or later.GlobalProtect App on Linux \n No action needed.GlobalProtect App on Windows No action needed.GlobalProtect App on iOS No action needed.GlobalProtect App on Android No action needed.GlobalProtect App on ChromeOS No action needed."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-10-14T16:00:00.000Z","value":"Initial Publication."}],"title":"GlobalProtect App: Local Privilege Escalation Vulnerability on macOS","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No known workarounds exist for this issue."}],"value":"No known workarounds exist for this issue."}],"x_affectedList":["GlobalProtect App 6.3.3","GlobalProtect App 6.3.2","GlobalProtect App 6.3.1","GlobalProtect App 6.3.0","GlobalProtect App 6.3","GlobalProtect App 6.2.8","GlobalProtect App 6.2.7","GlobalProtect App 6.2.6","GlobalProtect App 6.2.4","GlobalProtect App 6.2.3","GlobalProtect App 6.2.2","GlobalProtect App 6.2.1","GlobalProtect App 6.2.0","GlobalProtect App 6.2"],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","assignerShortName":"palo_alto","cveId":"CVE-2026-0315","datePublished":"2026-10-14T20:24:21.191Z","dateReserved":"2025-11-03T20:45:13.819Z","dateUpdated":"2026-10-16T03:56:58.518Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-14 21:17:18","lastModifiedDate":"2026-10-16 04:18:05","problem_types":["CWE-426","CWE-426 CWE-426 Untrusted Search Path"],"metrics":{"cvssMetricV40":[{"source":"psirt@paloaltonetworks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T00:00:00+00:00","id":"CVE-2026-0315","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"315","Ordinal":"1","Title":"GlobalProtect App: Local Privilege Escalation Vulnerability on m","CVE":"CVE-2026-0315","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"315","Ordinal":"1","NoteData":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.","Type":"Description","Title":"GlobalProtect App: Local Privilege Escalation Vulnerability on m"}]}}}