GlobalProtect App: Local Privilege Escalation Vulnerabilities_CVE-2026-0251

5.9 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Description

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

Basic Information

ID CVE-2026-0251

Source palo_alto

Published May 13, 2026 at 18:20

Modified May 13, 2026 at 18:56

Affected Product

Vendor Palo Alto Networks

Product GlobalProtect App

Version 6.3.0

Affected Versions Palo Alto Networks GlobalProtect App 6.3.0
Palo Alto Networks GlobalProtect App 6.2.0
Palo Alto Networks GlobalProtect App 6.0.0
Palo Alto Networks GlobalProtect App 6.3.0
Palo Alto Networks GlobalProtect App 6.2.0
Palo Alto Networks GlobalProtect App 6.0.0
Palo Alto Networks GlobalProtect App 6.3.0
Palo Alto Networks GlobalProtect App 6.0.0

CWE Classification

CWE-426

References

security.paloaltonetworks.com /CVE-2026-0251

{
    "lastseen": "",
    "description": "Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app allow a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.",
    "published": "2026-05-13T18:20:01.156Z",
    "modified": "2026-05-13T18:56:49.781Z",
    "type": "cve",
    "title": "GlobalProtect App: Local Privilege Escalation Vulnerabilities",
    "source": "palo_alto",
    "references": "https://security.paloaltonetworks.com/CVE-2026-0251",
    "id": "CVE-2026-0251",
    "bulletinFamily": "",
    "cwe": [
        "CWE-426"
    ],
    "cvelist": null,
    "sourceData": "Palo Alto Networks GlobalProtect App 6.3.0\nPalo Alto Networks GlobalProtect App 6.2.0\nPalo Alto Networks GlobalProtect App 6.0.0\nPalo Alto Networks GlobalProtect App 6.3.0\nPalo Alto Networks GlobalProtect App 6.2.0\nPalo Alto Networks GlobalProtect App 6.0.0\nPalo Alto Networks GlobalProtect App 6.3.0\nPalo Alto Networks GlobalProtect App 6.0.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "GlobalProtect App",
    "version": "6.3.0",
    "vendor": "Palo Alto Networks",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}