CVE-2026-0315: GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (Severity: MEDIUM)
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.8-h15Fixed in 6.3.3-h16 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App on macOSto a version that resolves this vulnerability.Fixed in 6.2.8-h15 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App on macOSto a version that resolves this vulnerability.Fixed in 6.3.3-h16
Event History
Frequently Asked Questions
Do GlobalProtect deployments on platforms other than macOS require remediation for this issue?
No. The Linux, Windows, iOS, Android, and Chrome OS versions of the GlobalProtect app are not affected.
What level of access does an attacker need?
An attacker must already have local access as a non-administrative user on an affected macOS system. No user interaction is required after that access is available.