CVE-2026-0267

MediumCVSS 5.5/10Last modified Jul 23, 2026

Description

An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Palo Alto Networks	GlobalProtect App	>= 6.3.0, < 6.3.3-h1; >= 6.2.0, < 6.2.8-h2
Palo Alto Networks	GlobalProtect App	—
Palo Alto Networks	GlobalProtect UWP App	—

References

https://security.paloaltonetworks.com/CVE-2024-8687Not Applicable
https://security.paloaltonetworks.com/CVE-2026-0267Vendor Advisory, Mitigation

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-02684.4A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tu CVE-2026-02695.7A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to CVE-2026-02707.5A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an CVE-2026-02717.8A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute CVE-2026-02727.2A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command CVE-2026-02737.2A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restriction CVE-2026-02749.1An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unaut CVE-2026-02756.7A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to CVE-2026-02767.8A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as CVE-2026-02775.9An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (Mit CVE-2026-02787.8Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to byp CVE-2026-02796.1Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/por