# CVE-2026-0267: Palo Alto Networks GlobalProtect app information exposure on macOS

Source: https://junglewise.ai/threats/cve-2026-0267-palo-alto-networks-globalprotect-app-information-exposure-on-macos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-0267 · Severity: info · CVSS 4.4 · Published 2026-06-10

A security issue in the Palo Alto Networks GlobalProtect app for macOS allows a person with local access to the computer to discover the administrative passcodes used to manage the software. Once these passcodes are known, the user can disable, disconnect, or uninstall the security software even if those actions were restricted by company policy. This could allow an employee or unauthorized user to bypass corporate security controls and network protections.

Technologies: [Palo Alto Networks GlobalProtect App](https://junglewise.ai/threats/technologies/globalprotect-app). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0267 being exploited in the wild.

**How severe is CVE-2026-0267?** Informational severity, with a CVSS score of 4.4, published 10 June 2026.

**Which products and versions are affected?** Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h1 on macOS, 6.2 < 6.2.8-h2 on macOS.

**Is there a fix for CVE-2026-0267?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0267 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-0267?** Check whether you run Palo Alto Networks GlobalProtect App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information exposure vulnerability (CWE-532) exists in the Palo Alto Networks GlobalProtect app for macOS where sensitive passcodes are inserted into log files or temporary files. A local attacker with low privileges can read these files to recover the configured passcodes for uninstalling, disabling, or disconnecting the GlobalProtect agent. This bypasses administrative restrictions intended to prevent users from tampering with the VPN client. The vulnerability specifically affects macOS deployments where the 'Allow User to Uninstall GlobalProtect App with Password' feature is enabled. Fixes are available in GlobalProtect app versions 6.3.3-h1 and 6.2.8-h2 for macOS.

## Affected products

- Palo Alto Networks GlobalProtect App 6.3 < 6.3.3-h1 on macOS, 6.2 < 6.2.8-h2 on macOS

## Timeline

- 2026-06-10: disclosed: Initial publication of the advisory
- 2026-06-10: advisory

## References

- [https://security.paloaltonetworks.com/CVE-2024-8687](https://security.paloaltonetworks.com/CVE-2024-8687)
- [https://security.paloaltonetworks.com/CVE-2026-0267](https://security.paloaltonetworks.com/CVE-2026-0267)

## Related threats

- [Palo Alto Networks GlobalProtect local privilege escalation](https://junglewise.ai/threats/cve-2026-0251-palo-alto-networks-globalprotect-local-privilege-escalation)
- [Palo Alto Networks GlobalProtect buffer overflow in Portal/Gateway communication](https://junglewise.ai/threats/cve-2026-0250-palo-alto-networks-globalprotect-buffer-overflow-in-portal-gateway)
- [Palo Alto Networks GlobalProtect improper certificate validation](https://junglewise.ai/threats/cve-2026-0249-palo-alto-networks-globalprotect-improper-certificate-validation)