# CVE-2026-0249: Palo Alto Networks GlobalProtect improper certificate validation

Source: https://junglewise.ai/threats/cve-2026-0249-palo-alto-networks-globalprotect-improper-certificate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-0249 · Severity: medium · CVSS 6.5 · Published 2026-05-13

Palo Alto Networks GlobalProtect is a security application used to provide secure VPN access for remote employees. A vulnerability in certain versions for macOS, Android, and ChromeOS allows attackers on the same network to intercept and redirect encrypted traffic to malicious servers. This could lead to the installation of unauthorized software or the compromise of the user's device.

Technologies: [Palo Alto Networks GlobalProtect App](https://junglewise.ai/threats/technologies/globalprotect-app). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0249 being exploited in the wild.

**How severe is CVE-2026-0249?** Medium severity, with a CVSS score of 6.5, published 13 May 2026.

**Which products and versions are affected?** Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h9 on macOS; 6.2 < 6.2.8-h10 on macOS; 6.1 < 6.1.13 on Android/ChromeOS; 6.0 < 6.0.14 on Android/ChromeOS; 6.0 < 6.0.13 on macOS.

**Is there a fix for CVE-2026-0249?** A patch was published on 2026-06-13: Updated patch availability for Android and ChromeOS versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0249 attacked?** It is attacked from the adjacent network or with local access, in a network appliance.

**Am I affected by CVE-2026-0249?** Check whether you run Palo Alto Networks GlobalProtect App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-295 (Improper Certificate Validation), which allows for Adversary-in-the-Middle (AiTM) attacks. On macOS, the issue is specifically triggered when SAML authentication with an embedded browser is enabled; on Android and ChromeOS, no special configuration is required. An attacker positioned on the same subnet or a local non-administrative user can redirect traffic to an unauthorized server, facilitating traffic interception or malicious software installation. The GlobalProtect app for Windows, Linux, and iOS is not affected. Patches are available in versions 6.0.13/6.0.14, 6.1.14, 6.2.8-h10, and 6.3.3-h9 depending on the platform.

## Affected products

- Palo Alto Networks GlobalProtect App macOS: 6.0.0 to 6.0.12, 6.2.0 to 6.2.8-h9, 6.3.0 to 6.3.3-h8; Android/ChromeOS: 6.0.0 to 6.0.13, 6.1.0 to 6.1.13

## Timeline

- 2026-05-13: advisory: Initial publication by Palo Alto Networks
- 2026-06-13: patched: Updated patch availability for Android and ChromeOS versions

## References

- [https://security.paloaltonetworks.com/CVE-2026-0249](https://security.paloaltonetworks.com/CVE-2026-0249)

## Related threats

- [Palo Alto Networks GlobalProtect app information exposure on macOS](https://junglewise.ai/threats/cve-2026-0267-palo-alto-networks-globalprotect-app-information-exposure-on-macos)
- [Palo Alto Networks GlobalProtect local privilege escalation](https://junglewise.ai/threats/cve-2026-0251-palo-alto-networks-globalprotect-local-privilege-escalation)
- [Palo Alto Networks GlobalProtect buffer overflow in Portal/Gateway communication](https://junglewise.ai/threats/cve-2026-0250-palo-alto-networks-globalprotect-buffer-overflow-in-portal-gateway)