CVE-2026-0298: GlobalProtect PLAP RCE Vulnerability

CVE-2026-0298 Overview

CVE-2026-0298 is an improper input validation vulnerability in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect app. An adjacent-network attacker positioned as a man-in-the-middle (MitM) can execute arbitrary code with SYSTEM privileges on an affected Windows client. The flaw is tracked under CWE-94: Improper Control of Generation of Code. GlobalProtect app installations on Linux, macOS, iOS, Android, and Chrome OS are not affected. Palo Alto Networks published the advisory as CVE-2026-0298.

Critical Impact
A MitM attacker on the same network segment as a pre-logon Windows endpoint can achieve arbitrary code execution as SYSTEM, gaining full control of the device before any user has authenticated.

Affected Products

Palo Alto Networks GlobalProtect app on Windows (PLAP component)
Windows endpoints configured to use GlobalProtect Pre-Logon Access Provider for network authentication
Windows clients performing pre-logon VPN tunnel establishment

Discovery Timeline

2026-08-13 - CVE-2026-0298 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-0298

Vulnerability Analysis

The vulnerability resides in the GlobalProtect Pre-Logon Access Provider, a Windows component that establishes a VPN tunnel before user logon. PLAP runs in the Winlogon context with SYSTEM privileges to enable domain authentication over the VPN. Improper input validation in this component allows a network-adjacent attacker to inject data that is processed as executable code. The classification under CWE-94 indicates the flaw enables code generation from attacker-controlled input rather than a simple memory corruption condition. Because PLAP operates before any user session exists, successful exploitation grants control over the machine before endpoint user-mode defenses activate for an interactive session.

Root Cause

The GlobalProtect PLAP component fails to properly validate input received from the network during the pre-logon authentication exchange. Under CWE-94: Improper Control of Generation of Code, attacker-supplied data flows into a code-generation or interpretation path without adequate sanitization. Palo Alto Networks has not disclosed the specific parsing routine or protocol field responsible for the flaw.

Attack Vector

Exploitation requires an adjacent-network position where the attacker can intercept and modify traffic between the Windows client and the GlobalProtect gateway. The attacker performs a man-in-the-middle attack against the PLAP authentication exchange, injecting crafted responses that trigger arbitrary code execution in the PLAP process. No user interaction is required because PLAP runs at the pre-logon screen. The resulting code runs with SYSTEM privileges. See the Palo Alto Networks advisory for vendor-provided technical details.

No public proof-of-concept code has been released, and no exploitation in the wild has been reported.

Detection Methods for CVE-2026-0298

Indicators of Compromise

Unexpected child processes spawned by the GlobalProtect PLAP process (PanGpHip.exe, PanGPS.exe, or related binaries) prior to user logon.
Anomalous outbound connections from pre-logon Windows endpoints to hosts other than the configured GlobalProtect portal or gateway.
TLS certificate validation warnings or mismatches logged by the GlobalProtect client during pre-logon tunnel establishment.

Detection Strategies

Monitor endpoint process trees for SYSTEM-context process creation originating from GlobalProtect PLAP binaries at the Windows lock or logon screen.
Alert on ARP cache poisoning, DHCP anomalies, or rogue gateway advertisements on network segments hosting Windows endpoints that use GlobalProtect pre-logon.
Correlate GlobalProtect client logs (PanGPS.log, PanGPA.log) with network telemetry to identify unexpected redirects during the PLAP handshake.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and GlobalProtect client logs into a centralized SIEM for pre-logon session correlation.
Track network flows from endpoints in the pre-logon state to detect deviations from the approved portal/gateway destinations.
Baseline expected PLAP authentication traffic patterns and alert on deviations in packet size, timing, or endpoints.

How to Mitigate CVE-2026-0298

Immediate Actions Required

Review the Palo Alto Networks security advisory for CVE-2026-0298 and inventory all Windows endpoints running the GlobalProtect app with PLAP enabled.
Apply the fixed GlobalProtect app version specified by Palo Alto Networks as soon as it is available for your deployment.
Enforce strict certificate pinning and validation for GlobalProtect portal and gateway connections to reduce MitM feasibility.

Patch Information

Palo Alto Networks maintains fix availability details in the official advisory for CVE-2026-0298. Administrators should consult the advisory for the exact GlobalProtect app versions that resolve the PLAP input-validation flaw on Windows and deploy them through their standard endpoint update process.

Workarounds

Disable the Pre-Logon Access Provider (PLAP) feature in the GlobalProtect portal configuration on Windows endpoints where pre-logon VPN connectivity is not strictly required.
Restrict Windows endpoints to trusted network segments and require 802.1X or equivalent Layer 2 authentication to limit attacker positioning for adjacent-network MitM.
Deploy non-Windows GlobalProtect clients (Linux, macOS, iOS, Android, Chrome OS) for use cases where feasible, as those platforms are not affected.

bash

# Configuration example: verify GlobalProtect PLAP status on a Windows endpoint
# List installed GlobalProtect version
reg query "HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup" /v Version

# Enumerate registered Pre-Logon Access Providers (PLAPs)
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers"

# Remove GlobalProtect from PLAP providers to disable pre-logon (test in a lab first)
# reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\{GUID}" /f