CVE-2026-0297: GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (Severity: MEDIUM)
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.3-h15Fixed in 6.0.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.3-h14Fixed in 6.2.8-h13Fixed in 6.0.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.5Fixed in 6.0.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.8-h13 (6.2.8-1045) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.3-h14 (6.3.3-1121) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.3-h15 - Configuration
In GlobalProtect Portal configuration, ensure a <Settings> section exists within the GlobalProtect section, then add the pre-deployment key full-chain-cert-verify with string value "yes" in /opt/paloaltonetworks/globalprotect/pangps.xml so the first client-to-portal connection performs full certificate chain verification.
Palo Alto Networks GlobalProtect Portal / pangps.xml full-chain-cert-verify = yes - Configuration
Enforce SSL-Only VPN Connections by disabling IPSec/UDP tunneling: on GlobalProtect gateway, go to Network > Gateway > Agent > Tunnel Setting and un-check "Enable IPSec" to allow SSL-only tunnel mode.
GlobalProtect Gateway (Tunnel Settings) Enable IPSec = unchecked - Configuration
Use the GlobalProtect app configuration option "Enable Strict Certificate Check" (introduced in GlobalProtect 6.2.8 and GlobalProtect app 6.3.3 on Windows and macOS) to enable the required certificate checks to mitigate the issue.
GlobalProtect app (Windows and macOS) Enable Strict Certificate Check = enabled - Operational
Restart macOS after applying the workaround/configuration change.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0297?
The severity of CVE-2026-0297 is rated as high with a score of 7.7.
How do I fix CVE-2026-0297?
To fix CVE-2026-0297, update the Palo Alto Networks GlobalProtect app to the latest version that addresses the buffer overflow vulnerability.
What systems are affected by CVE-2026-0297?
CVE-2026-0297 affects the Palo Alto Networks GlobalProtect app running on Windows and macOS systems.
What type of vulnerability is CVE-2026-0297?
CVE-2026-0297 is a buffer overflow vulnerability that can allow for arbitrary code execution.
What are the potential impacts of CVE-2026-0297?
The potential impacts of CVE-2026-0297 include system disruption and escalation of privileges to SYSTEM on Windows or root on macOS.