CyberCVE

CVE-2026-0250

GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway

Severity
Medium 5.2
CVSS 4.0
Exploited
Not listed
EPSS
0.004
31.9th percentile
Discovered by
Vendor
Published by the vendor
Published
May 13, 2026
Assigned by palo_alto

Description

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected.

Weakness: CWE-787

Affected products

Vendor Product Category Matched by
Palo Alto Networks GlobalProtect VPN & Remote Access cna-assigner
Vendor-reported affected versions (7)
  • Palo Alto Networks · GlobalProtect App
  • Palo Alto Networks · GlobalProtect App
  • Palo Alto Networks · GlobalProtect App
  • Palo Alto Networks · GlobalProtect App
  • Palo Alto Networks · GlobalProtect App
  • Palo Alto Networks · GlobalProtect UWP App
  • Palo Alto Networks · GlobalProtect App

Credit

our internal security research teams

Vendor remediation

VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h8 Upgrade to 6.3.3-h9 (6.3.3-999) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (6.2.8-948) or later. GlobalProtect App 6.0 on Windows 6.0.0 through 6.0.12 Upgrade to 6.0.13 or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.10 Upgrade to 6.0.11 or later. GlobalProtect App 6.2/6.3 on Linux 6.2.0 through 6.3.3-h1 Upgrade to 6.3.3-h2 (6.3.3-42) or later. GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h8 Upgrade to 6.3.3-h9 (6.3.3-999) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (6.2.8-948) or later. GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.12 Upgrade to 6.0.13 or later. GlobalProtect App 6.1 on Android 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on Android 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect App 6.1 on ChromeOS 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on ChromeOS 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect UWP App 6.1.0 through 6.3.3-h9 Upgrade to 6.3.3-h10 or later. GlobalProtect App on iOS No action needed

References