Palo Alto Networks Issues Fix for macOS GlobalProtect Privilege Escalation

Palo Alto Networks has released a security advisory for CVE-2026-0315, a local privilege escalation vulnerability in its GlobalProtect application for macOS. The flaw allows a non-administrative user with local access to execute arbitrary commands with full root privileges, bypassing standard administrative restrictions.

The vendor rates the severity of this issue as medium, with a suggested urgency of moderate. The Common Vulnerability Scoring System base score is 8.5, reflecting the high impact on confidentiality, integrity, and availability for the local user. Palo Alto Networks states it is not aware of any malicious exploitation of this specific vulnerability in the wild.

Context and Background

This vulnerability is specific to the macOS implementation of the GlobalProtect client. The company confirmed that the GlobalProtect applications for Linux, Windows, iOS, Android, and Chrome OS are not affected by this issue. No special configuration is required for a system to be vulnerable; any installation of the affected versions on macOS is exposed by default.

The advisory lists multiple versions within the 6.2 and 6.3 release lines as vulnerable. Specifically, versions from 6.2.0 up to but not including 6.2.8-h15 are affected. Additionally, versions from 6.3.0 up to but not including 6.3.3-h16 are also vulnerable. This wide range of affected versions suggests that many users may have been running susceptible software for some time.

As Threat Times reported on 2026-10-14 regarding similar privilege escalation issues in other software, such flaws can allow low-privileged users to gain root access. While that earlier report covered Hestia Control Panel and Frontend Dashboard plugins, the principle of local privilege escalation remains a significant risk for endpoint security across different platforms.

Who is Affected

Organizations using the GlobalProtect app on macOS devices are the primary concern. The vulnerability impacts any local user account that is not an administrator. If an attacker can gain physical access to a device or compromise a standard user account, they can leverage this flaw to elevate their privileges.

The affected software versions include 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.6, 6.2.7, 6.2.8, 6.3.0, 6.3.1, 6.3.2, and 6.3.3. Users on these specific builds must update their software to mitigate the risk. The vulnerability does not extend to other operating systems supported by the GlobalProtect suite.

What should you do?

Administrators should immediately verify the version of the GlobalProtect app installed on all macOS devices within their environment. If the version is among those listed as vulnerable, they should deploy the update to version 6.3.3-h16 (build 6.3.3-1199) or later. This update resolves the privilege escalation issue described in CVE-2026-0315.

Monitoring for unexpected privilege changes or unauthorized command execution on macOS endpoints is also advisable. Since the vendor has not reported active exploitation, the risk is currently theoretical, but the potential impact of gaining root access is high.

What to do and how to stay safe: Palo Alto Networks

• Audit all macOS devices to identify installations of GlobalProtect App versions 6.2.0 through 6.3.3.
• Deploy the vendor-provided update to version 6.3.3-h16 or later on all affected systems.
• Review local user activity logs for signs of privilege escalation attempts or unauthorized command execution.
• Ensure that endpoint detection and response tools are configured to alert on suspicious process behavior.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the GlobalProtect app for Windows affected by CVE-2026-0315?

No, Palo Alto Networks confirmed that the vulnerability only affects the macOS version of the GlobalProtect app.

What is the CVSS score for this vulnerability?

The CVSS base score is 8.5, with a vector string indicating local attack vector and high impact.

Is there evidence that hackers are currently exploiting this flaw?

No, Palo Alto Networks stated it is not aware of any malicious exploitation of this issue.