CVE-2026-0295 release notes and known issues

GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

Scope: GlobalProtect App. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

GlobalProtect App

Affected versions

< 6.3.3-h14 (6.3.3-1121) on macOS
< 6.2.8-h13 (6.2.8-1045) on macOS
< 6.0.15 on macOS
None on Linux, None on Windows, None on iOS, None on Android, None on Chrome OS

Fixed versions or updates

>= 6.3.3-h14 (6.3.3-1121) on macOS
>= 6.2.8-h13 (6.2.8-1045) on macOS
>= 6.0.15 on macOS (ETA: 10/29)
All on Linux, All on Windows, All on iOS, All on Android, All on Chrome OS

Recommended action

VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later. GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. GlobalProtect App on Linux No action needed. GlobalProtect App on Windows No action needed. GlobalProtect App on iOS No action needed. GlobalProtect App on Android No action needed. GlobalProtect App on Chrome OS No action needed.

Related vulnerabilities

BlackTree CVE Intelligence

CVE-2026-0295Open CVE report →

Official publisher evidence

PALO ALTO NETWORKSVERIFIED

GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

Checked 9 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source