CVE-2026-0249

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.paloaltonetworks.com/CVE-2026-0249	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::android::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::chrome::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::android::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::chrome::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h1::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9::::macos::*

History

No history.

Information

Published : 2026-05-13 19:16

Updated : 2026-07-14 16:40

NVD link : CVE-2026-0249

Mitre link : CVE-2026-0249

CVE.ORG link : CVE-2026-0249

JSON object : View

Products Affected

paloaltonetworks

globalprotect

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-0249", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0249", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T03:56:08.016080Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 4.9, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@paloaltonetworks.com", "affectedData": [{"vendor": "Palo Alto Networks", "product": "GlobalProtect App", "versions": [{"status": "affected", "changes": [{"at": "6.3.3-h9 (6.3.3-999)", "status": "unaffected"}], "version": "6.3.0", "lessThan": "6.3.3-h9 (6.3.3-999)", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "6.2.8-h10 (6.2.8-948)", "status": "unaffected"}], "version": "6.2.0", "lessThan": "6.2.8-h10 (6.2.8-948)", "versionType": "custom"}], "platforms": ["macOS"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "GlobalProtect App", "versions": [{"status": "affected", "changes": [{"at": "6.1.13", "status": "unaffected"}], "version": "6.1.0", "lessThan": "6.1.13", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "6.0.14", "status": "unaffected"}], "version": "6.0.0", "lessThan": "6.0.14", "versionType": "custom"}], "platforms": ["Android", "ChromeOS"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "GlobalProtect App", "versions": [{"status": "affected", "changes": [{"at": "6.0.13", "status": "unaffected"}], "version": "6.0.0", "lessThan": "6.0.13", "versionType": "custom"}], "platforms": ["macOS"], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "GlobalProtect App", "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "platforms": ["Windows", "Linux", "iOS", "Windows UWP"], "defaultStatus": "unaffected"}]}], "published": "2026-05-13T19:16:59.073", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0249", "tags": ["Vendor Advisory"], "source": "psirt@paloaltonetworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.\n\nThe GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected."}], "lastModified": "2026-07-14T16:40:37.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "821399ED-2A5C-4684-841D-BE489E85FB72", "versionEndExcluding": "6.0.13", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "9D17932B-9562-4B29-A8F9-01EE8B21442F", "versionEndExcluding": "6.0.14", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:chrome:*:*", "vulnerable": true, "matchCriteriaId": "B812B0B6-1FC2-437D-A514-6414A93E36DB", "versionEndExcluding": "6.0.14", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "C6CA9D61-7D4D-489F-9640-D88A30F6037A", "versionEndExcluding": "6.1.14", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:chrome:*:*", "vulnerable": true, "matchCriteriaId": "541408B7-62AB-4A23-AD6B-8EB9298FBD0A", "versionEndExcluding": "6.1.14", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "84C4C650-DBCF-488A-AD29-84347162D48B", "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.2.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "EFAA1A23-5A3C-48FA-8672-D8329D67A14C", "versionEndExcluding": "6.3.3", "versionStartIncluding": "6.3.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:-:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "F781BC4A-B907-4393-A94A-D200A0BD73E3"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h1:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "77C49DC4-CC2B-46C3-9122-40B399E657A6"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.8:h7:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "9F6A6D49-B2DE-4359-83B3-D3239559CE64"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h1:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "1BCA9A56-9AFB-4C97-B597-C3F1DC786A35"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h2:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "D3632AD0-54EB-4CA4-AB41-983B6965B30E"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h3:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "82E3F152-A98F-4B12-B9B7-8F2E3DB8A6A5"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h4:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "EC0A413D-5F2C-4FE8-ADE6-A78244A7E132"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h6:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "B7A8F2F7-85C7-4456-9E71-F94F3DF96356"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h7:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "7472FAD0-A40D-437A-82DA-70A7B959A62C"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h8:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "B6C0F18B-802C-43D5-AEDD-05B7E5A53CED"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:6.3.3:h9:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "50E2642D-EB58-4B5D-B218-F5E6DB97D382"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@paloaltonetworks.com"}