CVE-2026-0249 - GlobalProtect App: Certificate Validation Bypass Vulnerabilities

Back Back to CVE browser

MEDIUM

GlobalProtect App: Certificate Validation Bypass Vulnerabilities

Published May 13, 2026

4.9

MEDIUM

CVSS 4.0

EPSS 0.11%

Description

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.

The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

Affected products

Vendor Palo Alto Networks Product GlobalProtect App Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.13
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.14
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.13
- Version
  6.2.0
  Status
  affected
  Constraints
  <6.2.8-h10 (6.2.8-948)
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.3-h9 (6.3.3-999)

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

GlobalProtect App

unaffected

Version	Status	Constraints
6.0.0	affected	<6.0.13
6.0.0	affected	<6.0.14
6.1.0	affected	<6.1.13
6.2.0	affected	<6.2.8-h10 (6.2.8-948)
6.3.0	affected	<6.3.3-h9 (6.3.3-999)

Remediation

Vendor solution

Version Minor Version Suggested Solution GlobalProtect App 6.1 on Android 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on Android 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect App 6.1 on Chrome OS 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on Chrome OS 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h8 Upgrade to 6.3.3-h9 (6.3.3-999) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (6.2.8-948) or later. GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.12 Upgrade to 6.0.13 or later. GlobalProtect App on Windows No action needed. GlobalProtect App on Linux No action needed. GlobalProtect App on iOS No action needed. GlobalProtect App on UWP No action needed.

Weaknesses (1)

CWE-295

Improper Certificate Validation