Status: EXPLOITED | Advisory ID: CVE-2026-0295
| CVE | CVE-2026-0295 |
| CVSS Score / Version | 7.0 (High) / CVSS v3.1 |
| Updated | 2026-09-20 |
| CVSS Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | Palo Alto Networks GlobalProtect |
| Exploitation status | Palo Alto Networks is not aware of any malicious exploitation of this issue. |
| Classified as | CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) |
| Exploitation prediction (EPSS) | 0.07% probability of exploitation in the next 30 days (0% percentile) -- FIRST.org's EPSS model. |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect |
| Subsystems | General OT |
| Sectors | Multi-sector |
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
GlobalProtect App 6.3 on macOS (6.3.0 through 6.3.3-h13): upgrade to 6.3.3-h14 (6.3.3-1121) or later. 6.2 on macOS (6.2.0 through 6.2.8-h12): upgrade to 6.2.8-h13 (6.2.8-1045) or later. 6.0 on macOS (6.0.0 through 6.0.14): upgrade to 6.0.15 or later. All other platforms: no action needed. Workarounds and Mitigations: no known workarounds.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-0295 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-0295 |
| Vendor advisory | https://security.paloaltonetworks.com/CVE-2026-0295 |