VULNpocalypse
MediumVulnerabilityPatch available

Palo Alto discloses GlobalProtect app buffer overflow CVE-2026-0250

Palo Alto Networks says GlobalProtect app flaw CVE-2026-0250 affects most platforms except iOS; it advises upgrading to a fixed version.

Published
Fixed in
Windows 6.3.3-h9, 6.2.8-h10, 6.0.13; macOS 6.3.3-h9, 6.2.8-h10, 6.0.13; Linux 6.3.3-h15, 6.0.15; Android and ChromeOS 6.3.5, 6.1.14, 6.0.14 or 6.0.15 per vendor table; UWP 6.3.3-h10
Exploitation
No, Palo Alto Networks says it is not aware of any malicious exploitation

Live scores

CVE-2026-0250
EPSS
0.004
low predicted chance of attack
VEDAS
0.052
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

Palo Alto Networks describes CVE-2026-0250 as a buffer overflow in the GlobalProtect app, according to its own PSIRT advisory. Palo Alto PSIRT The vendor says a man in the middle attacker could use it to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. It says the flaw is triggered while the app processes requests and responses exchanged between Portal and Gateway. Palo Alto PSIRT

According to Palo Alto Networks, the advisory was published on 2026-05-13 and last updated on 2026-11-10. The vendor says it discovered the issue internally and thanks its internal security research teams. It classifies the weakness as CWE-787 (out-of-bounds write). Palo Alto PSIRT

Palo Alto Networks rates it CVSS-B 7.7 and CVSS-BT 5.2 (MEDIUM), with a suggested urgency of MODERATE. It lists the attack vector as adjacent and says no privileges or user interaction are required. Palo Alto PSIRT

What is not confirmed: this advisory rests on a single source, the vendor’s own advisory, and no independent verification of the details is confirmed. The vendor says it is not aware of any malicious exploitation. Palo Alto PSIRT

Am I affected?

According to Palo Alto Networks, no special configuration is required to be affected, and the GlobalProtect app on iOS is not affected. The vendor lists these versions as affected, by branch and platform: Palo Alto PSIRT

  • GlobalProtect App 6.3: Windows and macOS before 6.3.3-h9; Linux before 6.3.3-h15; Android and ChromeOS before 6.3.5.
  • GlobalProtect App 6.2: Windows and macOS before 6.2.8-h10; Linux is covered by a combined 6.2/6.3 entry, through 6.3.3-h14.
  • GlobalProtect App 6.1: Android and ChromeOS before 6.1.14.
  • GlobalProtect App 6.0: Windows and macOS before 6.0.13; Linux, Android and ChromeOS before 6.0.15 (the solution table also names 6.0.14 as an upgrade target for Android and ChromeOS).
  • GlobalProtect UWP App: Windows before 6.3.3-h10.

The advisory is not fully consistent for Android and ChromeOS: the product status table gives 6.3.5 as the unaffected 6.3 version, while some solution rows mention 6.3.4. Check the advisory directly. The vendor also marks 6.0.15 for Linux, Android and ChromeOS with “ETA: 01/27”, so availability of that build is not confirmed here.

What to do now

  1. Identify which GlobalProtect app versions and platforms are deployed in your environment, including Linux, Android, ChromeOS and the UWP app.
  2. Upgrade to the fixed version the vendor lists for your branch: Windows and macOS 6.3.3-h9 (6.3.3-999), 6.2.8-h10 (6.2.8-948) or 6.0.13; Linux 6.3.3-h15 or 6.0.15; Android and ChromeOS 6.3.5 or the branch fixes in the advisory; UWP 6.3.3-h10. Palo Alto PSIRT
  3. Do not plan around a workaround. Palo Alto Networks says no known workarounds exist. Palo Alto PSIRT
  4. No action is needed for the iOS app, according to the vendor. Palo Alto PSIRT
  5. Re-check the advisory page for updates, since it shows an update date later than its publication date.

Sources