OTPulse

GlobalProtect App: Local Denial of Service (DoS) on Windows

MonitorCVSS 6.8CVE-2026-0314Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

A type confusion vulnerability in Palo Alto Networks GlobalProtect app on Windows allows a local user with low privileges to cause a denial of service (DoS) condition by crashing the VPN client. The vulnerability does not affect GlobalProtect on Linux, macOS, iOS, Android, or Chrome OS. Vendor has released patched versions: 6.3.3-h16 (6.3.3-1199) and 6.2.8-h15 (6.2.8-1084).

What this means
What could happen
A local attacker with low privileges on a Windows machine running GlobalProtect can crash the VPN client, interrupting secure access to your network and potentially disrupting remote work or field operations until the service is restarted.
Who's at risk
Water utilities and municipal electric companies with field technicians, remote engineers, or administrative staff connecting via GlobalProtect on Windows laptops or desktops. Any organization relying on GlobalProtect for secure remote access to SCADA, HMI, or engineering systems is affected.
How it could be exploited
An attacker with a local user account on a Windows machine running GlobalProtect exploits a type confusion flaw in the app to send a malformed request, causing the GlobalProtect process to crash. The attacker needs no special permissions or authentication to the app itself—just local access to the Windows system.
Prerequisites
  • Local user account on the affected Windows machine
  • GlobalProtect app version below 6.3.3-h16 or 6.2.8-h15
Low complexity exploitationLocal attacker onlyDenial of service impactAffects VPN connectivity
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
GlobalProtect AppBelow 6.3.3-h16 (6.3.3-1199) on Windows6.3.3-h16 (6.3.3-1199) on Windows+
GlobalProtect AppBelow 6.2.8-h15 (6.2.8-1084) on Windows6.2.8-h15 (6.2.8-1084) on Windows+
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

GlobalProtect App
HOTFIXUpdate GlobalProtect app to version 6.3.3-h16 (6.3.3-1199) or later on Windows systems
HOTFIXUpdate GlobalProtect app to version 6.2.8-h15 (6.2.8-1084) or later on Windows systems if you cannot upgrade to 6.3.3
All products
HOTFIXPrioritize patching systems used by remote workers and field staff who rely on continuous VPN connectivity
View full vendor advisory
API: /api/v1/advisories/8ce24ce3-7f66-412a-9321-5688ed1982ba

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.