CVE-2026-0267: GlobalProtect App: Information Exposure Vulnerability on macOS (Severity: MEDIUM)
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.3-h1Fixed in 6.2.8-h2 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App (macOS)to a version that resolves this vulnerability.Fixed in 6.2.8-h2 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App (macOS)to a version that resolves this vulnerability.Fixed in 6.3.3-h1 - Configuration
On the GlobalProtect Portal configuration on PAN-OS firewalls or Panorama, change 'Allow User to Uninstall GlobalProtect App' to 'Disallow' (if currently enabled).
GlobalProtect Portal configuration (PAN-OS Firewall/Panorama) Network > GlobalProtect > Portals > (portal-config) > Agent > (agent-config) > App > Allow User to Uninstall GlobalProtect App = Disallow
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0267?
CVE-2026-0267 has a medium severity score of 6.9 according to CVSS.
How do I fix CVE-2026-0267?
To fix CVE-2026-0267, change the setting to 'Disallow' for allowing user uninstallation in GlobalProtect Portal configuration and upgrade to the recommended app versions.
What type of vulnerability is CVE-2026-0267?
CVE-2026-0267 is classified as an information exposure vulnerability affecting the GlobalProtect app on macOS.
Who is affected by CVE-2026-0267?
CVE-2026-0267 affects users of the Palo Alto Networks GlobalProtect app on macOS who have access to configured passcodes.
What action can be taken by a user exploiting CVE-2026-0267?
A user exploiting CVE-2026-0267 can learn the configured passcodes to disable, disconnect, or uninstall the GlobalProtect app.