CVE-2026-0251
Estado: AnalizadaMedia (5.9)—
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
- Puntuación base: 5.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.18%
- Percentil entre todas las CVEs puntuadas: 7
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-426
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-0251",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-0251",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-05-13T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "psirt@paloaltonetworks.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "USER",
"baseScore": 5.9,
"Automatable": "NO",
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
"exploitMaturity": "UNREPORTED",
"providerUrgency": "AMBER",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "psirt@paloaltonetworks.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"vendor": "Palo Alto Networks",
"product": "GlobalProtect App",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "6.3.3-h9 (6.3.3-999)",
"status": "unaffected"
}
],
"version": "6.3.0",
"lessThan": "6.3.3-h9 (6.3.3-999)",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "6.2.8-h10 (6.2.8-948)",
"status": "unaffected"
}
],
"version": "6.2.0",
"lessThan": "6.2.8-h10 (6.2.8-948)",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "6.0.13",
"status": "unaffected"
}
],
"version": "6.0.0",
"lessThan": "6.0.13",
"versionType": "custom"
}
],
"platforms": [
"Windows"
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*"
],
"vendor": "Palo Alto Networks",
"product": "GlobalProtect App",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "6.3.3-h9 (6.3.3-999)",
"status": "unaffected"
}
],
"version": "6.3.0",
"lessThan": "6.3.3-h9 (6.3.3-999)",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "6.2.8-h10 (6.2.8-948)",
"status": "unaffected"
}
],
"version": "6.2.0",
"lessThan": "6.2.8-h10 (6.2.8-948)",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "6.0.13",
"status": "unaffected"
}
],
"version": "6.0.0",
"lessThan": "6.0.13",
"versionType": "custom"
}
],
"platforms": [
"macOS"
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"vendor": "Palo Alto Networks",
"product": "GlobalProtect App",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "6.3.3-h2 (6.3.3-42)",
"status": "unaffected"
}
],
"version": "6.3.0",
"lessThan": "6.3.3-h2 (6.3.3-42)",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "6.0.11",
"status": "unaffected"
}
],
"version": "6.0.0",
"lessThan": "6.0.11",
"versionType": "custom"
}
],
"platforms": [
"Linux"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Palo Alto Networks",
"product": "Global Protect App",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
],
"platforms": [
"Android",
"ChromeOS",
"iOS",
"UWP"
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-05-13T19:16:59.470",
"references": [
{
"url": "https://security.paloaltonetworks.com/CVE-2026-0251",
"tags": [
"Vendor Advisory"
],
"source": "psirt@paloaltonetworks.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@paloaltonetworks.com",
"description": [
{
"lang": "en",
"value": "CWE-426"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected."
}
],
"lastModified": "2026-07-14T16:40:02.357",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "8277CB05-B6EE-4051-A5D1-BC33C0C3A3B0",
"versionEndExcluding": "6.0.11",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "821399ED-2A5C-4684-841D-BE489E85FB72",
"versionEndExcluding": "6.0.13",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "518C5EB1-B8A3-4B05-B727-47EA7B1FE513",
"versionEndExcluding": "6.0.13",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "84C4C650-DBCF-488A-AD29-84347162D48B",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "6.2.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "98296E39-B40D-4F25-9D0C-C9CACFE25814",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "6.2.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "B04AEEDD-8875-4B06-816D-9AA905F6ABE3",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "6.3.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "EFAA1A23-5A3C-48FA-8672-D8329D67A14C",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "6.3.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "3A842EBF-EA01-4D05-96C5-7F2061951423",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "6.3.0"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "F781BC4A-B907-4393-A94A-D200A0BD73E3"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "95312A9E-9204-451C-85F9-891312FDFAA4"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h1:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "77C49DC4-CC2B-46C3-9122-40B399E657A6"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "9F6A6D49-B2DE-4359-83B3-D3239559CE64"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "CDA02D18-0121-442D-844A-D7B8D70F4853"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:-:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "D8495DBE-5B93-495D-9726-E4360942464B"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:-:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "47AAC03D-0E33-430D-AB58-CABCC1546285"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:-:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "8BD47595-78F1-4CD4-AD9A-572C1B128FD4"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:linux:*:*",
"vulnerable": true,
"matchCriteriaId": "E4CF788E-01C0-4D49-9E83-EFD161E9B112"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "1BCA9A56-9AFB-4C97-B597-C3F1DC786A35"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "AF40C5A7-BAD7-47A8-BCA6-31685E91B339"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "D3632AD0-54EB-4CA4-AB41-983B6965B30E"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "8868A339-6229-487A-8D16-4B06ECB132AE"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "82E3F152-A98F-4B12-B9B7-8F2E3DB8A6A5"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "FB1C2ACF-8931-410A-BFE8-2E4DE3D15A0D"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "EC0A413D-5F2C-4FE8-ADE6-A78244A7E132"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "2C0EAAFC-5ED3-4D96-A0CE-EDBD4246CD7A"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "B7A8F2F7-85C7-4456-9E71-F94F3DF96356"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "7D4FFE1D-5707-4DC4-B783-46AAA5D8D037"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "7472FAD0-A40D-437A-82DA-70A7B959A62C"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "AFC6221C-3D39-4F51-86F4-826D7B72D4E5"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "B6C0F18B-802C-43D5-AEDD-05B7E5A53CED"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "EC8FBE7C-A3FE-4CBB-947D-F2BA1DB0D39C"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "50E2642D-EB58-4B5D-B218-F5E6DB97D382"
},
{
"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9:*:*:*:windows:*:*",
"vulnerable": true,
"matchCriteriaId": "97E3C343-A602-400E-979C-84CFEB4B75FE"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@paloaltonetworks.com"
}