Palo Alto Networks GlobalProtect App Local Privilege Escalation via Untrusted Search Path

CVE-2026-0307 covers multiple local privilege escalation flaws in the Palo Alto Networks GlobalProtect app on Windows, macOS, and Linux desktops. The root cause is CWE-426 (Untrusted Search Path): the GlobalProtect service, running as NT AUTHORITY\SYSTEM (Windows) or root (macOS/Linux), loads libraries or executables from directories a standard user can write to. A local, low-privileged attacker can plant a malicious DLL or binary in the search path and wait for the privileged service to execute it, gaining full SYSTEM/root on the host. Affected versions are 6.3 < 6.3.3-h15, 6.2 < 6.2.8-h14, and 6.0 < 6.0.15. iOS, Android, and ChromeOS clients are unaffected.

Palo Alto published a CVSS v4.0 base score of 8.5 but applied their own environmental and threat adjustments to arrive at 5.9 MEDIUM. That adjusted score is honest. The base score of 8.5 reflects the raw impact (full host compromise), but the local-access-only attack vector, absence of any public PoC, zero known exploitation in the wild, and host-scoped blast radius all compress the real-world risk. GlobalProtect is a VPN *client* — not an identity provider, hypervisor, or domain controller — so popping SYSTEM on one endpoint doesn't cascade to fleet-level compromise by itself. The MEDIUM bucket is the right neighborhood.

Why this verdict

• Local access prerequisite (AV:L, PR:L): The attacker must already have a foothold on the endpoint. This is not reachable from the network. Every internet-facing attack surface metric (Shodan, Censys, GreyNoise) is irrelevant. This single prerequisite implies the attacker has already passed initial access — compounding downward pressure from the 8.5 base.
• No PoC, no exploitation, no KEV: Zero evidence of weaponization. CWE-426 is a well-understood class, but without a named hijackable path, building a reliable exploit requires reverse engineering the service's load order. EPSS will likely score this below the 10th percentile once ingested.
• Host-scoped blast radius: Successful exploitation yields SYSTEM/root on *one endpoint*. There is no lateral-movement amplifier inherent in the GlobalProtect client component itself.
• Role multiplier: GlobalProtect is a VPN *client agent* deployed on user workstations and laptops. (a) *Low-value role:* dev sandbox or lab — LPE is inconsequential. (b) *Typical role:* corporate laptop — SYSTEM access aids credential theft and lateral movement, but EDR + Credential Guard + network segmentation contain the blast radius to one host. (c) *High-value role consideration:* GlobalProtect does NOT typically run on domain controllers, hypervisors, CI/CD servers, or identity providers. It is not a kernel-mode security agent (it runs as a user-mode service). The nearest high-value scenario is an admin workstation with cached privileged credentials — but this is a deployment-specific condition, not inherent to the component. The blast radius does NOT reach fleet/domain/supply-chain scale from the component itself. No verdict floor override triggered.
• Vendor environmental adjustment validates MEDIUM: Palo Alto's own CVSS v4.0 environmental scoring reduced the base 8.5 to 5.9 MEDIUM using E:U (unreported exploitation) and V:D (diffuse value). Our independent friction audit arrives at the same bucket.

Why not higher?

Upgrading to HIGH would require either active exploitation, a public PoC lowering the skill barrier, or a blast radius beyond the individual host. None of these conditions exist. The local-access-only vector means the attacker is already inside — this CVE is a *convenience link* in an existing chain, not a chain-starter. GlobalProtect's deployment role (endpoint VPN client) does not meet the high-value-role floor criteria for domain/fleet/supply-chain impact.

Why not lower?

Dropping to LOW would understate the impact of a reliable local-to-SYSTEM/root escalation on enterprise-managed endpoints. CWE-426 is a well-understood vulnerability class that lowers the skill barrier for anyone with local access. The affected population is large (every GP desktop client in the enterprise), and SYSTEM access on a corporate endpoint has real operational value for credential theft and EDR evasion. The absence of workarounds also means the only remediation is patching.

1. Enable Windows Defender Application Control (WDAC) or AppLocker in enforced mode — Block unsigned or unexpected DLLs from loading in the GlobalProtect service context. This directly breaks the CWE-426 exploitation chain by preventing the untrusted library from executing. Deploy this as your primary compensating control within the 365-day noisgate remediation SLA for MEDIUM.
2. Restrict write permissions on GlobalProtect installation directories — Audit and lock down ACLs on C:\Program Files\Palo Alto Networks\GlobalProtect\ (Windows) and /opt/paloaltonetworks/globalprotect/ (Linux) so only SYSTEM/root can write. This prevents standard users from planting libraries in the service's search path.
3. Monitor for DLL sideloading via EDR — Create detection rules for unsigned DLL loads by PanGPS.exe, PanGPA.exe, or globalprotect service processes. Sysmon Event ID 7 or equivalent EDR telemetry will surface exploitation attempts before they succeed.
4. Enable Credential Guard on Windows endpoints — Even if an attacker achieves SYSTEM, Credential Guard prevents extraction of domain credentials from LSASS, severely limiting the post-exploitation value of this LPE.

Run on each Windows endpoint where GlobalProtect is installed. Execute in an elevated PowerShell session: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-0307.ps1. No special modules required. For macOS/Linux, check the version string from globalprotect show --version against the thresholds below.

# Check-CVE-2026-0307.ps1
# Checks if the installed GlobalProtect app is vulnerable to CVE-2026-0307
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

function Compare-Version ($installed, $fixed) {
    # Normalize hotfix versions: 6.3.3-h15 -> 6.3.3.15
    $instNorm = $installed -replace '-h', '.'
    $fixNorm  = $fixed -replace '-h', '.'
    try {
        $iv = [Version]$instNorm
        $fv = [Version]$fixNorm
        return $iv.CompareTo($fv)
    } catch {
        return $null
    }
}

# Try to find GlobalProtect version from registry
$regPaths = @(
    'HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect',
    'HKLM:\SOFTWARE\WOW6432Node\Palo Alto Networks\GlobalProtect'
)
$version = $null
foreach ($rp in $regPaths) {
    if (Test-Path $rp) {
        $version = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).Version
        if ($version) { break }
    }
}

# Fallback: check PanGPA.exe file version
if (-not $version) {
    $exePath = "$env:ProgramFiles\Palo Alto Networks\GlobalProtect\PanGPA.exe"
    if (Test-Path $exePath) {
        $fi = (Get-Item $exePath).VersionInfo
        $version = $fi.ProductVersion
    }
}

if (-not $version) {
    Write-Host 'UNKNOWN - GlobalProtect not detected on this host.'
    exit 2
}

Write-Host "Detected GlobalProtect version: $version"

# Define fixed versions per branch
$fixedVersions = @{
    '6.3' = '6.3.3-h15'
    '6.2' = '6.2.8-h14'
    '6.0' = '6.0.15'
}

# Determine branch
$branch = $null
if ($version -match '^6\.3\.') { $branch = '6.3' }
elseif ($version -match '^6\.2\.') { $branch = '6.2' }
elseif ($version -match '^6\.0\.') { $branch = '6.0' }
else {
    Write-Host "UNKNOWN - Version $version is not in a known affected branch (6.0, 6.2, 6.3)."
    exit 2
}

$fixed = $fixedVersions[$branch]
$cmp = Compare-Version $version $fixed

if ($null -eq $cmp) {
    Write-Host "UNKNOWN - Could not parse version '$version' for comparison."
    exit 2
}

if ($cmp -lt 0) {
    Write-Host "VULNERABLE - GlobalProtect $version is below fixed version $fixed for branch $branch. CVE-2026-0307 applies."
    exit 1
} else {
    Write-Host "PATCHED - GlobalProtect $version meets or exceeds fixed version $fixed."
    exit 0
}

Sources

1. Palo Alto Networks Advisory — CVE-2026-0307
2. Palo Alto Networks Advisory — CVE-2026-0251 (sibling LPE)
3. Palo Alto Networks Advisory — CVE-2026-0299 (sibling LPE)
4. OpenCVE — CVE-2026-0299 Details
5. CybersecurityNews — GlobalProtect Root Privilege Escalation
6. Feedly CVE Intelligence — CVE-2026-0251
7. MITRE CWE-426 — Untrusted Search Path