CVE-2026-0296 - GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

Back Back to CVE browser

MEDIUM

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

Published Aug 13, 2026

4.5

MEDIUM

CVSS 4.0

EPSS 0.14%

Description

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.

The GlobalProtect app on iOS, Android, and Chrome OS is not affected.

Affected products

Vendor Palo Alto Networks Product GlobalProtect App Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.15
- Version
  6.2.0
  Status
  affected
  Constraints
  <6.2.8-h13
- Version
  6.2.0
  Status
  affected
  Constraints
  -
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.3-h14
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.3-h15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

GlobalProtect App

unaffected

Version	Status	Constraints
6.0.0	affected	<6.0.15
6.2.0	affected	<6.2.8-h13
6.2.0	affected	-
6.3.0	affected	<6.3.3-h14
6.3.0	affected	<6.3.3-h15

Remediation

Vendor solution

VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later. GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later. GlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. GlobalProtect App on iOS No action needed. GlobalProtect App on Android No action needed. GlobalProtect App on Chrome OS No action needed.

Weaknesses (1)

CWE-295

Improper Certificate Validation