Is CVE-2026-0267 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0267 being exploited in the wild.

How severe is CVE-2026-0267?

Informational severity, with a CVSS score of 4.4, published 10 June 2026.

Which products and versions are affected?

Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h1 on macOS, 6.2 < 6.2.8-h2 on macOS.

Is there a fix for CVE-2026-0267?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-0267 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-0267?

Check whether you run Palo Alto Networks GlobalProtect App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0267: Palo Alto Networks GlobalProtect app information exposure on macOS

Q: Is there a fix for CVE-2026-0267?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-0267 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-0267?

Check whether you run Palo Alto Networks GlobalProtect App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0267 · Severity: info · CVSS 4.4 · Published 2026-06-10

A security issue in the Palo Alto Networks GlobalProtect app for macOS allows a person with local access to the computer to discover the administrative passcodes used to manage the software. Once these passcodes are known, the user can disable, disconnect, or uninstall the security software even if those actions were restricted by company policy. This could allow an employee or unauthorized user to bypass corporate security controls and network protections.

Technologies: Palo Alto Networks GlobalProtect App. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0267 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0267 being exploited in the wild.
How severe is CVE-2026-0267?: Informational severity, with a CVSS score of 4.4, published 10 June 2026.
Which products and versions are affected?: Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h1 on macOS, 6.2 < 6.2.8-h2 on macOS.
Is there a fix for CVE-2026-0267?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0267 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-0267?: Check whether you run Palo Alto Networks GlobalProtect App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information exposure vulnerability (CWE-532) exists in the Palo Alto Networks GlobalProtect app for macOS where sensitive passcodes are inserted into log files or temporary files. A local attacker with low privileges can read these files to recover the configured passcodes for uninstalling, disabling, or disconnecting the GlobalProtect agent. This bypasses administrative restrictions intended to prevent users from tampering with the VPN client. The vulnerability specifically affects macOS deployments where the 'Allow User to Uninstall GlobalProtect App with Password' feature is enabled. Fixes are available in GlobalProtect app versions 6.3.3-h1 and 6.2.8-h2 for macOS.

Affected products

Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h1 on macOS, 6.2 < 6.2.8-h2 on macOS

Timeline

2026-06-10: disclosed: Initial publication of the advisory
2026-06-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.