CVE-2026-0250: Palo Alto Networks GlobalProtect buffer overflow in Portal/Gateway communication

CVE-2026-0250 · Severity: high · CVSS 8.1 · Published 2026-05-13

A security vulnerability has been identified in the Palo Alto Networks GlobalProtect app, which is used to provide secure remote access to corporate networks. An attacker positioned between a user's device and the corporate gateway could exploit this flaw to disrupt the connection or potentially take full control of the user's computer with administrative privileges. This issue affects versions on Windows, macOS, Linux, Android, and ChromeOS, but does not impact iOS devices.

Technologies: Palo Alto Networks GlobalProtect App. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0250 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0250 being exploited in the wild.
How severe is CVE-2026-0250?
High severity, with a CVSS score of 8.1, published 13 May 2026.
Which products and versions are affected?
Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h9 (Windows, macOS); 6.3 < 6.3.3-h2 (Linux); 6.2 < 6.2.8-h10 (Windows, macOS); 6.1 < 6.1.13 (Android, ChromeOS); 6.0 < 6.0.11 (Linux); 6.0 < 6.0.13 (Windows, macOS); 6.0 < 6.0.14 (Android, ChromeOS); Palo Alto Networks GlobalProtect UWP 6.1.0 through 6.3.3-h9; Palo Alto Networks GlobalProtect UWP App 6.1.0 through 6.3.3-h9 (Windows).
Is there a fix for CVE-2026-0250?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0250 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-0250?
Check whether you run Palo Alto Networks GlobalProtect App, Palo Alto Networks GlobalProtect UWP or Palo Alto Networks GlobalProtect UWP App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-787) exists in the Palo Alto Networks GlobalProtect app during the processing of requests and responses exchanged between the Portal and Gateway. The vulnerability can be triggered by a man-in-the-middle (MitM) attacker with an adjacent network position. Successful exploitation allows the attacker to disrupt system processes or achieve arbitrary code execution with SYSTEM privileges on the host operating system. The vulnerability affects multiple platforms including Windows, macOS, Linux, Android, and ChromeOS, while the iOS version is explicitly noted as unaffected. Security updates have been released for all affected branches.

Affected products

  • Palo Alto Networks GlobalProtect App 6.0.x, 6.1.x, 6.2.x, 6.3.x (Windows, macOS, Linux, Android, ChromeOS)
  • Palo Alto Networks GlobalProtect UWP App 6.1.0 through 6.3.3-h9

Timeline

  • 2026-05-13: advisory: Initial advisory publication
  • 2026-06-13: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.