GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
Plan PatchCVSS 8.5CVE-2026-0315Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a non-administrative user to escalate their privileges to root and execute arbitrary commands with administrative privileges. The vulnerability affects GlobalProtect versions below 6.2.8-h15 (6.2.8-1084) and below 6.3.3-h16 (6.3.3-1199) on macOS. GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS are not affected.
What this means
What could happen
A local user on macOS could gain administrative control of their machine and potentially compromise any VPN connections or sensitive data the organization relies on through that endpoint. This could enable lateral movement to network resources if the compromised machine is used to access critical infrastructure or control systems.
Who's at risk
Organizations using macOS endpoints with GlobalProtect VPN client should prioritize this update. This affects any remote workers, engineers, or staff using macOS laptops or desktops to access corporate networks, VPN services, or potentially industrial control systems remotely. Particular concern for utilities and critical infrastructure organizations where remote access to operational networks is common.
How it could be exploited
An attacker with local access to a macOS machine running vulnerable GlobalProtect (non-administrative user account) could exploit a privilege escalation flaw to gain root-level privileges on that machine. Once elevated, the attacker could execute arbitrary commands, modify VPN credentials, or intercept traffic intended for corporate networks.
Prerequisites
- Local access to the macOS machine with a non-administrative user account
- Vulnerable version of GlobalProtect app installed and running on macOS
local exploitation onlyno authentication requiredaffects endpoint security posturecould enable lateral movement to critical networks
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
GlobalProtect AppBelow 6.2.8-h15 (6.2.8-1084) on macOS6.2.8-h15 (6.2.8-1084) on macOS+
GlobalProtect AppBelow 6.3.3-h16 (6.3.3-1199) on macOS6.3.3-h16 (6.3.3-1199) on macOS+
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict physical and login access to macOS machines running GlobalProtect to authorized administrative users only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
GlobalProtect App
HOTFIXUpdate GlobalProtect app on macOS to version 6.2.8-h15 (6.2.8-1084) or later for the 6.2.x branch
HOTFIXUpdate GlobalProtect app on macOS to version 6.3.3-h16 (6.3.3-1199) or later for the 6.3.x branch
Long-term hardening
0/1HARDENINGAudit and enforce strong password policies and multi-factor authentication on all macOS endpoints accessing corporate networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/6a3bb251-cad9-4eb7-95c2-4fb70d80a59dGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.