CVE-2026-0298
Full vulnerability record from the local CVENow database.
Description
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Severity
MEDIUM
CVSS score
5.2
(v4.0)
Vulnerability status
Undergoing Analysis
Source identifier
Published
2026-08-13 03:16:45.560000
Last modified
2026-10-23 19:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-0298",
"sourceIdentifier": "[email protected]",
"published": "2026-08-13T03:16:45.560",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\n\nThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de validación de entrada incorrecta en el componente Proveedor de Acceso Pre-Inicio de Sesión (PLAP) de Windows de la aplicación GlobalProtect™ de Palo Alto Networks en dispositivos Windows, lo que permite a un atacante man-in-the-middle (MitM) ejecutar código arbitrario con privilegios de SYSTEM en un cliente afectado.\n\nLa aplicación GlobalProtect en Linux, macOS, iOS, Android y Chrome OS no está afectada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Palo Alto Networks",
"product": "GlobalProtect App",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"platforms": [
"Windows"
],
"versions": [
{
"version": "6.3.0",
"lessThan": "6.3.3-h14",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
]
},
{
"version": "6.2.0",
"lessThan": "6.2.8-h13",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
]
},
{
"version": "6.0.0",
"lessThan": "6.0.15",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Palo Alto Networks",
"product": "GlobalProtect App",
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"Android",
"Chrome OS",
"iOS"
],
"versions": [
{
"version": "All",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NO",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "AMBER"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T03:55:53.877148Z",
"id": "CVE-2026-0298",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.0.15",
"matchCriteriaId": "B6B99D3F-4125-4268-89EE-F5E1D2825220"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"versionStartIncluding": "6.2.0",
"versionEndExcluding": "6.2.8",
"matchCriteriaId": "98296E39-B40D-4F25-9D0C-C9CACFE25814"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"versionStartIncluding": "6.3.0",
"versionEndExcluding": "6.3.3",
"matchCriteriaId": "3A842EBF-EA01-4D05-96C5-7F2061951423"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.0.15:*:*:*:*:windows:*:*",
"matchCriteriaId": "E75CCA9D-4C07-4FA8-B76E-649F917E0526"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-:*:*:*:windows:*:*",
"matchCriteriaId": "95312A9E-9204-451C-85F9-891312FDFAA4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h10:*:*:*:windows:*:*",
"matchCriteriaId": "0133464D-CBF8-4F3D-BAA7-8A1BA95499E8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h11:*:*:*:windows:*:*",
"matchCriteriaId": "E39FE847-4BEF-4B9E-B91C-6E2DE40FFBDA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h12:*:*:*:windows:*:*",
"matchCriteriaId": "0870E3AC-4204-49D9-9E6A-FD61D574856D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h2:*:*:*:windows:*:*",
"matchCriteriaId": "EE661AE5-ACD8-45D3-A4C0-66627B635D83"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h3:*:*:*:windows:*:*",
"matchCriteriaId": "859BDAB2-3EB8-45EC-9CF2-D79B08B736E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h4:*:*:*:windows:*:*",
"matchCriteriaId": "EEA19771-8B8E-447E-B251-C01577765C27"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h5:*:*:*:windows:*:*",
"matchCriteriaId": "B747517B-2566-4A0F-8A8A-B654A5A81A14"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h6:*:*:*:windows:*:*",
"matchCriteriaId": "AD0FB4D7-D1A4-465E-9137-0759E1B14E42"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7:*:*:*:windows:*:*",
"matchCriteriaId": "CDA02D18-0121-442D-844A-D7B8D70F4853"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h8:*:*:*:windows:*:*",
"matchCriteriaId": "3AEB0428-3FE0-4FDF-830F-55FDA009108E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h9:*:*:*:windows:*:*",
"matchCriteriaId": "AFFD725B-4A3B-47F9-8E56-15AAA607C8AA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:-:*:*:*:windows:*:*",
"matchCriteriaId": "8BD47595-78F1-4CD4-AD9A-572C1B128FD4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:windows:*:*",
"matchCriteriaId": "AF40C5A7-BAD7-47A8-BCA6-31685E91B339"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h11:*:*:*:windows:*:*",
"matchCriteriaId": "E48A0B52-AFFF-4B01-88E2-E7E4C6FC488A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h12:*:*:*:windows:*:*",
"matchCriteriaId": "FD3BE68E-A378-4D0A-8008-234861B749DF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2:*:*:*:windows:*:*",
"matchCriteriaId": "8868A339-6229-487A-8D16-4B06ECB132AE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3:*:*:*:windows:*:*",
"matchCriteriaId": "FB1C2ACF-8931-410A-BFE8-2E4DE3D15A0D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4:*:*:*:windows:*:*",
"matchCriteriaId": "2C0EAAFC-5ED3-4D96-A0CE-EDBD4246CD7A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6:*:*:*:windows:*:*",
"matchCriteriaId": "7D4FFE1D-5707-4DC4-B783-46AAA5D8D037"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7:*:*:*:windows:*:*",
"matchCriteriaId": "AFC6221C-3D39-4F51-86F4-826D7B72D4E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8:*:*:*:windows:*:*",
"matchCriteriaId": "EC8FBE7C-A3FE-4CBB-947D-F2BA1DB0D39C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9:*:*:*:windows:*:*",
"matchCriteriaId": "97E3C343-A602-400E-979C-84CFEB4B75FE"
}
]
}
]
}
],
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0298",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}