Palo Alto Networks Discloses Local DoS Flaw in Windows GlobalProtect App
A type confusion vulnerability in the Windows version of GlobalProtect allows local users to trigger a denial of service condition.
Key points
- CVE-2026-0314 affects Windows versions of the GlobalProtect app from 6.0.0 through 6.3.3.
- The flaw enables low-privilege local users to cause a denial of service via type confusion.
- Linux, macOS, iOS, Android, and Chrome OS versions of the application are not affected.
Palo Alto Networks has disclosed CVE-2026-0314, a medium-severity vulnerability in its GlobalProtect application for Windows. The flaw allows a local user with low privileges to trigger a denial of service condition on the host machine.
The issue stems from a type confusion error within the software. According to the Palo Alto Networks PSIRT advisory, this CWE-843 flaw does not require special configuration to be exploited. The vendor rates the severity as medium with a moderate urgency for remediation.
Context and Background
The Common Vulnerability Scoring System version 4.0 base score for CVE-2026-0314 is 6.8. This rating reflects the local attack vector and the high impact on availability. The base threat score is lower at 4.3, indicating limited exploitability under standard threat conditions.
Palo Alto Networks stated it is not aware of any malicious exploitation of this issue in the wild. As Threat Times reported on 2026-10-14, Microsoft recently confirmed a critical remote code execution flaw in Windows RRAS, highlighting ongoing risks in network services.
Who is Affected
The vulnerability impacts GlobalProtect App versions 6.0.0 through 6.0.14 on Windows. It also affects versions 6.2.0 through 6.2.8 and versions 6.3.0 through 6.3.3 on the Windows platform. The advisory lists specific CPE identifiers for each affected minor version.
The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability. Users of these operating systems do not face the local denial of service risk described in the advisory. No special configuration is required for Windows systems to be vulnerable.
What should you do?
Administrators should verify the version of the GlobalProtect app installed on their Windows endpoints. Those running versions between 6.0.0 and 6.3.3 are exposed to this local denial of service flaw. The vendor has not explicitly confirmed a patch release in the provided material, so monitoring for updates is essential.
What to do and how to stay safe: Palo Alto Networks
- Audit endpoint inventories to identify Windows machines running vulnerable GlobalProtect versions.
- Restrict local user privileges on endpoints where the vulnerable software is installed.
- Monitor vendor communications for the release of a patched version or update.
- Evaluate the necessity of the GlobalProtect app on devices where local threat exposure is high.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-0314 affect macOS or Linux versions of GlobalProtect?
No, the vulnerability only affects the Windows version of the GlobalProtect app.
What is the CVSS score for this vulnerability?
The CVSS v4.0 base score is 6.8, which Palo Alto Networks rates as medium severity.
Are there any known exploits for CVE-2026-0314?
Palo Alto Networks is not aware of any malicious exploitation of this issue.
