Palo Alto Updates GlobalProtect CVE-2026-0307 Fixed Builds
Tech GuruQuick Answer
Palo Alto Networks updated CVE-2026-0307 on October 17 with revised GlobalProtect 6.2.8 and 6.3.3 fixed releases and explicit build numbers. Reconcile desktop clients by platform, update the corresponding PAN-OS or Prisma Access infrastructure, validate the paired remediation, monitor privileged execution and upgrade failures, and retain evidence.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory GlobalProtect desktop clients by platform and build plus their PAN-OS or Prisma Access dependency, preserve evidence, deploy the platform-specific fixed client and matching fixed infrastructure build, validate authentication and connectivity, and document exceptions.
Last verified: 2026-10-17 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GlobalProtect app 6.0, 6.2, and 6.3 on Windows, macOS, and Linux with related PAN-OS or Prisma Access infrastructure |
|---|---|
| Advisory | CVE-2026-0307 |
| CVE | CVE-2026-0307 |
| Authoritative release date | 2026-09-09; Palo Alto Networks publishes the initial date without a time |
| Authority revision date | 2026-10-17 00:55:00 UTC; affected and fixed versions revised and build numbers added |
| Affected versions | Advisory-listed GlobalProtect desktop builds before the platform-specific fixed releases, together with affected PAN-OS 10.2 through 12.2 or Prisma Access 10.2 through 12.1 deployments; iOS, Android, and ChromeOS are unaffected. |
| Fixed version | GlobalProtect 6.3.3-h15 build 6.3.3-c63 for Linux; 6.3.3-h16 build 6.3.3-1199 for Windows or macOS; 6.2.8-h15 build 6.2.8-1084 for Windows or macOS; or 6.0.15 for the listed platforms, plus the matching advisory-listed PAN-OS or Prisma Access fixed build |
| CVSS base score | 8.5 (official CVSS v4.0 base) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks is not aware of malicious exploitation; no exploitation claim is inferred. |
What Changed
Palo Alto Networks revised affected and fixed GlobalProtect versions for the 6.2.8 and 6.3.3 branches and added build numbers. Full remediation still requires both the desktop app and related PAN-OS or Prisma Access environment to reach advisory-listed fixed versions. The authority states that it is not aware of malicious exploitation.
What To Validate Now
- Inventory. Record GlobalProtect version, build and platform for Windows, macOS, and Linux clients; map each client population to the responsible PAN-OS gateway or Prisma Access tenant; and identify deployment and rollback owners.
- Establish applicability. Use the October 17 advisory table to match both the platform-specific client range and related PAN-OS or Prisma Access version. iOS, Android, and ChromeOS are unaffected.
- Remediate. Deploy the exact platform-specific GlobalProtect fixed build and the corresponding advisory-listed PAN-OS or Prisma Access fixed release. Do not treat a client-only or infrastructure-only update as complete remediation.
- Validate. Confirm installed client build and infrastructure release, test authentication, tunnel establishment, routing, DNS, policy enforcement, upgrade delivery and rollback, and review endpoint and gateway logs for anomalies.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The October 17 revision changes previously tracked 6.2.8 and 6.3.3 fixed-build details. Reconcile automation and exception records to the current platform-specific table, stage connectivity-sensitive upgrades, and do not infer compromise from the CVSS score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
