Palo Alto Networks Revises GlobalProtect Privilege Escalation Fixes
Tech GuruQuick Answer
CVE-2026-0307 lets a local, low-privileged user escalate privileges through an affected GlobalProtect app. Palo Alto Networks' September 30 revision adds estimated fix dates, not proof that the builds are available. Match the client's operating system and branch to the solution table, then coordinate the app update with the required PAN-OS or Prisma Access update. Updating only one side does not complete remediation.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory affected GlobalProtect clients and their connected PAN-OS or Prisma Access infrastructure, map each branch to the exact solution-table fix and ETA, schedule both sides of the remediation, validate authentication and connectivity, and retain version and change evidence.
Last verified: 2026-10-01 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GlobalProtect app 6.0, 6.2, and 6.3 on Windows, macOS, and Linux with related PAN-OS or Prisma Access infrastructure |
|---|---|
| Advisory | CVE-2026-0307 |
| CVE | CVE-2026-0307 |
| Authoritative release date | 2026-09-09 (initial advisory publication) |
| Authority revision date | 2026-09-30 (fixed-release availability estimates added) |
| Affected versions | Advisory-listed GlobalProtect 6.0, 6.2, and 6.3 desktop builds together with affected PAN-OS 10.2 through 12.2 or Prisma Access 10.2 through 12.1 deployments; iOS, Android, and ChromeOS are unaffected. |
| Fixed version | Linux 6.2/6.3: 6.3.3-h15; Windows/macOS 6.3: 6.3.3-h15; Windows/macOS 6.2: 6.2.8-h14 (vendor ETA October 6). Desktop 6.0: 6.0.15 (ETA October 29). Use the listed release or later, plus the matching advisory-listed PAN-OS or Prisma Access fix. ETAs are not availability confirmation. |
| CVSS base score | 8.5 (official CVSS v4.0 base) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks is not aware of malicious exploitation; no exploitation claim is inferred. |
What Changed
The September 30 revision estimates October 6 for 6.3.3-h15 and 6.2.8-h14, and October 29 for 6.0.15. The Linux 6.2/6.3 solution is 6.3.3-h15; 6.2.8-h14 is the 6.2 fix for Windows and macOS. Check the live table and download availability before scheduling either side of the remediation.
What To Validate Now
- Inventory. Locate GlobalProtect 6.0, 6.2, and 6.3 clients on Windows, macOS, and Linux; record client version, endpoint owner, local-user exposure, portal or gateway, PAN-OS or Prisma Access version, and maintenance ownership.
- Establish applicability. Match every client and infrastructure component to the September 30 solution table. iOS, Android, and ChromeOS are unaffected; do not infer that updating only the client or only PAN-OS fully remediates the issue.
- Remediate. Use the OS-specific client mapping above once the build is available, together with the exact PAN-OS or Prisma Access fix for the installed branch. Do not use 6.2.8-h14 as the Linux 6.2 fix. Palo Alto Networks lists no workaround.
- Validate. Confirm both client and infrastructure versions, test portal and gateway authentication, tunnel establishment, policy, upgrade, disconnect, and recovery workflows, review endpoint and gateway logs, and document exceptions or delayed branches.
Operational Cautions
The dates remain vendor estimates, and no workaround is listed. Palo Alto Networks reports no known malicious exploitation; that does not establish that a particular endpoint is uncompromised. Coordinate Prisma Access timing with the vendor if an earlier maintenance window is required.
Evidence To Retain
- Asset and owner identifiers, exact product and release, architecture or platform, relevant configuration, and the applicability decision.
- UTC timestamps and vendor advisory revision, change approval, before-and-after versions, and installer or package-manager output.
- Relevant logs, validation results, exceptions, compensating controls, and recovery or rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
