{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-0298", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:56.118Z", "datePublished": "2026-08-13T02:02:47.196Z", "dateUpdated": "2026-08-13T13:20:48.963Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-08-13T02:02:47.196Z" }, "title": "GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)", "datePublic": "2026-08-12T16:00:00.000Z", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "type": "CWE" } ] } ], "impacts": [ { "capecId": "CAPEC-242", "descriptions": [ { "lang": "en", "value": "CAPEC-242 Code Injection" } ] } ], "affected": [ { "vendor": "Palo Alto Networks", "product": "GlobalProtect App", "platforms": [ "Windows" ], "versions": [ { "status": "affected", "version": "6.3.0", "lessThan": "6.3.3-h14", "changes": [ { "at": "6.3.3-h14", "status": "unaffected" } ], "versionType": "custom" }, { "status": "affected", "version": "6.2.0", "lessThan": "6.2.8-h13", "changes": [ { "at": "6.2.8-h13", "status": "unaffected" } ], "versionType": "custom" }, { "status": "affected", "version": "6.0.0", "lessThan": "6.0.15", "changes": [ { "at": "6.0.15", "status": "unaffected" } ], "versionType": "custom" } ], "defaultStatus": "unaffected", "cpes": [ "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*", "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*" ] }, { "vendor": "Palo Alto Networks", "product": "GlobalProtect App", "platforms": [ "Linux", "macOS", "Android", "Chrome OS", "iOS" ], "versions": [ { "status": "unaffected", "version": "All", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "cpeApplicability": [ { "operator": "OR", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*", "versionStartIncluding": "6.3.0", "versionEndExcluding": "6.3.3-h14" }, { "vulnerable": true, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*", "versionStartIncluding": "6.2.0", "versionEndExcluding": "6.2.8-h13" }, { "vulnerable": true, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.15" } ] }, { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": false, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:linux:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:macos:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*" } ] } ] } ], "descriptions": [ { "lang": "en", "value": "An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\n\nThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.

The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected." } ] } ], "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0298", "tags": [ "vendor-advisory" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.2, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" } } ], "configurations": [ { "lang": "eng", "value": "This issue is applicable only to devices configured to use SAML authentication in the GlobalProtect Connect Before Logon (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) feature.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

This issue is applicable only to devices configured to use SAML authentication in the GlobalProtect Connect Before Logon feature.

" } ] } ], "workarounds": [ { "lang": "eng", "value": "Customers can mitigate the risk of this issue by taking either of the following actions:\n\n 1. Use Connect Before Logon (CBL (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method)) (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) without SAML Authentication\n\n 2. Use Pre-logon with machine certificate (https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-access-vpn-with-pre-logon) instead of Connect Before Logon (CBL).", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Customers can mitigate the risk of this issue by taking either of the following actions:

  1. Use Connect Before Logon (CBL) without SAML Authentication

  2. Use Pre-logon with machine certificate instead of Connect Before Logon (CBL).

" } ] } ], "solutions": [ { "lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App All on macOS No action needed.\nGlobalProtect App All on Linux No action needed.\nGlobalProtect App All on iOS No action needed.\nGlobalProtect App All on Android No action needed.\nGlobalProtect App All on Chrome OS No action needed.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "\n \n \n \n \n \n \n \n \n \n \n \n
Version
Minor Version
Suggested Solution
GlobalProtect App 6.3 on Windows
6.3.0 through 6.3.3-h13Upgrade to 6.3.3-h14 (6.3.3-1121) or later.
GlobalProtect App 6.2 on Windows
6.2.0 through 6.2.8-h12Upgrade to 6.2.8-h13 (6.2.8-1045) or later.
GlobalProtect App 6.0 on Windows
6.0.0 through 6.0.14Upgrade to 6.0.15 or later.
GlobalProtect App All on macOS
No action needed.
GlobalProtect App All on Linux
No action needed.
GlobalProtect App All on iOS
No action needed.
GlobalProtect App All on Android
No action needed.
GlobalProtect App All on Chrome OS
No action needed.
" } ] } ], "exploits": [ { "lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue." } ] } ], "timeline": [ { "time": "2026-08-12T16:00:00.000Z", "lang": "en", "value": "Initial Publication" } ], "credits": [ { "lang": "en", "value": "our internal security research teams", "type": "finder" } ], "source": { "discovery": "INTERNAL" }, "x_generator": { "engine": "Vulnogram 0.1.0-dev" }, "x_affectedList": [ "GlobalProtect App 6.3.3", "GlobalProtect App 6.3.2", "GlobalProtect App 6.3.1", "GlobalProtect App 6.3.0", "GlobalProtect App 6.3", "GlobalProtect App 6.2.8", "GlobalProtect App 6.2.7", "GlobalProtect App 6.2.6", "GlobalProtect App 6.2.4", "GlobalProtect App 6.2.3", "GlobalProtect App 6.2.2", "GlobalProtect App 6.2.1", "GlobalProtect App 6.2.0", "GlobalProtect App 6.2", "GlobalProtect App 6.0.14", "GlobalProtect App 6.0.13", "GlobalProtect App 6.0.12", "GlobalProtect App 6.0.11", "GlobalProtect App 6.0.10", "GlobalProtect App 6.0.8", "GlobalProtect App 6.0.7", "GlobalProtect App 6.0.6", "GlobalProtect App 6.0.5", "GlobalProtect App 6.0.4", "GlobalProtect App 6.0.3", "GlobalProtect App 6.0.2", "GlobalProtect App 6.0.1", "GlobalProtect App 6.0.0", "GlobalProtect App 6.0" ], "x_cpeGeneratedAt": "2026-08-12T02:10:58.226Z", "x_cpeManuallyEdited": true }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-08-13T03:55:53.877148Z", "id": "CVE-2026-0298", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:20:48.963Z" } } ] } }