CVE-2026-0267 GlobalProtect App: Information Exposure Vulnerability on macOS
Description
An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| GlobalProtect App | None on Windows, Linux, iOS, Android, Chrome OS | All on Windows, Linux, iOS, Android, Chrome OS |
| GlobalProtect App 6.3 | < 6.3.3-h1 on macOS | >= 6.3.3-h1 on macOS |
| GlobalProtect App 6.2 | < 6.2.8-h2 on macOS | >= 6.2.8-h2 on macOS |
| GlobalProtect UWP App | None | All |
Required Configuration for Exposure
This issue applies to GlobalProtect app deployments where the following feature is enabled on the GlobalProtect Portal configuration on PAN-OS firewalls or Panorama:
- Network > GlobalProtect > Portals > (portal-config) > Agent > (agent-config) > App > Allow User to Uninstall GlobalProtect App > Allow with Password
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 4.4 / CVSS-B: 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-532 Insertion of Sensitive Information into Log File
CAPEC-155 Screen Temporary Files for Sensitive Information
Solution
| Version | Minor Version Range | Suggested Solution |
|---|---|---|
| GlobalProtect App 6.3 on macOS | 6.3.0 through 6.3.3 | Upgrade to 6.3.3-h1 or later. |
| GlobalProtect App 6.2 on macOS | 6.2.0 through 6.2.8-h1 | Upgrade to 6.2.8-h2 or later. |
| GlobalProtect App on Windows | Not Applicable | |
| GlobalProtect App on Linux | Not Applicable | |
| GlobalProtect App on iOS | Not Applicable | |
| GlobalProtect App on Android | Not Applicable | |
| GlobalProtect App on Chrome OS | Not Applicable |
Workarounds and Mitigations
On the GlobalProtect Portal configuration on PAN-OS firewalls or Panorama, change the following setting (if enabled) to "Disallow":
- Network > GlobalProtect > Portals > (portal-config) > Agent > (agent-config) > App > Allow User to Uninstall GlobalProtect App > Disallow
Acknowledgments
CPEs
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*
CPE Applicability
- cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:* is vulnerable from (including)6.3.3 and up to (excluding)6.3.3-h1
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:* is vulnerable from (including)6.2.8 and up to (excluding)6.2.8-h2