Palo Alto Networks Security Advisories / CVE-2026-0249

CVE-2026-0249 GlobalProtect App: Certificate Validation Bypass Vulnerabilities

Urgency MODERATE

047910
Severity 4.9 · MEDIUM
Exploit Maturity UNREPORTED
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector ADJACENT
Attack Complexity LOW
Attack Requirements PRESENT
Automatable NO
User Interaction NONE
Product Confidentiality HIGH
Product Integrity HIGH
Product Availability NONE
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE
CVE JSON CSAF
Published 2026-05-13
Updated 2026-05-13
Discovered externally

Description

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.

The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

Product Status

VersionsAffectedUnaffected
GlobalProtect AppNone on Windows
None on Linux
None on iOS
None on Windows UWP
All on Windows
All on Linux
All on iOS
All on Windows UWP
GlobalProtect App 6.3< 6.3.3-h9 (6.3.3-999) on macOS
>= 6.3.3-h9 (6.3.3-999) on macOS
GlobalProtect App 6.2< 6.2.8-h10 (6.2.8-948) on macOS
>= 6.2.8-h10 (6.2.8-948) on macOS
GlobalProtect App 6.1< 6.1.13 on Android
< 6.1.13 on ChromeOS
>= 6.1.13 on Android
>= 6.1.13 on ChromeOS
GlobalProtect App 6.0< 6.0.14 on Android
< 6.0.14 on ChromeOS
< 6.0.13 on macOS
>= 6.0.14 on Android (ETA: 05/20)
>= 6.0.14 on ChromeOS (ETA: 05/20)
>= 6.0.13 on macOS

Required Configuration for Exposure

The issue is applicable to the GlobalProtect app on macOS only if SAML authentication with an embedded browser is enabled. No special configuration is required for the GlobalProtect app on Android/Chrome OS to be affected by this issue.

Severity: MEDIUM, Suggested Urgency: MODERATE

CVSS-BT: 4.9 / CVSS-B: 7.6 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of these issues.

Weakness Type and Impact

CWE-295 Improper Certificate Validation

CAPEC-94 Adversary in the Middle (AiTM)

Solution

VersionMinor VersionSuggested Solution
GlobalProtect App 6.1 on Android6.1.0 through 6.1.12Upgrade to 6.1.13 or later.
GlobalProtect App 6.0 on Android6.0.0 through 6.0.13Upgrade to 6.0.14 or later.
GlobalProtect App 6.1 on Chrome OS6.1.0 through 6.1.12Upgrade to 6.1.13 or later.
GlobalProtect App 6.0 on Chrome OS6.0.0 through 6.0.13Upgrade to 6.0.14 or later.
GlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h8Upgrade to 6.3.3-h9 (6.3.3-999) or later.
GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h9Upgrade to 6.2.8-h10 (6.2.8-948) or later.
GlobalProtect App 6.0 on macOS6.0.0 through 6.0.12Upgrade to 6.0.13 or later.
GlobalProtect App on Windows
No action needed.
GlobalProtect App on Linux
No action needed.
GlobalProtect App on iOS
No action needed.
GlobalProtect App on UWP
No action needed.

Workarounds and Mitigations

No known workarounds exist for this issue.

Acknowledgments

Palo Alto Networks thanks Kakao Corp. Service Security Team and our internal security research teams for discovering and reporting this issue.

CPE Applicability

Timeline

Initial publication.
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2026 Palo Alto Networks, Inc. All rights reserved.