CVE-2026-0251 Palo Alto Networks CVE debrief

Who should care

Users of Palo Alto Networks GlobalProtect app on Windows, macOS, and Linux should apply patches to prevent local privilege escalation attacks. This includes administrators and security teams managing these systems. Vulnerability management and security teams should review and update their deployments. Operators of affected systems should prioritize patching to prevent potential exploitation.

Technical summary

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate their privileges to NT AUTHORITY SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS, and GlobalProtect UWP app are not affected. Affected systems should be patched or mitigated according to vendor guidance.

Defensive priority

High

Recommended defensive actions

• Apply patches provided by Palo Alto Networks
• Inventory and update affected GlobalProtect app installations
• Monitor for suspicious activity
• Implement compensating controls
• Retest and verify patches
• Review and update vulnerability management processes
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerabilities and affected versions. The GlobalProtect app on Windows, macOS, and Linux are affected. Users should verify their deployments and apply patches. Evidence is limited to public sources and may not cover all affected systems or deployment contexts. Defenders should review official advisories and track vendor guidance for updates.

Official resources