CVE-2026-0299 Overview
CVE-2026-0299 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app. A local, authenticated user can escalate privileges to NT AUTHORITY\SYSTEM on Windows and to root on macOS and Linux. Successful exploitation allows a non-administrative user to execute arbitrary commands with administrative privileges on the host. The underlying weakness is classified as Untrusted Search Path [CWE-426]. GlobalProtect app installations on iOS, Android, and Chrome OS are not affected by this issue.
Critical Impact
A local, low-privileged user can gain full administrative control (SYSTEM or root) on Windows, macOS, and Linux endpoints running the vulnerable GlobalProtect app.
Affected Products
- Palo Alto Networks GlobalProtect app on Windows
- Palo Alto Networks GlobalProtect app on macOS
- Palo Alto Networks GlobalProtect app on Linux
Discovery Timeline
- 2026-08-13 - CVE-2026-0299 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-0299
Vulnerability Analysis
The GlobalProtect app runs privileged components on Windows, macOS, and Linux endpoints to manage VPN tunnels, certificates, and connectivity policies. CVE-2026-0299 allows a local user with standard privileges to influence how those privileged components locate or load supporting resources. As a result, the privileged process performs actions on behalf of an unprivileged user with elevated authority. The weakness is tracked as Untrusted Search Path [CWE-426], indicating that the application resolves a resource path in a location that a non-administrative user can control.
Root Cause
The root cause is improper handling of search paths used by a privileged GlobalProtect process. When a privileged component references an executable, library, or configuration file without fully qualifying its trusted location, a local attacker can plant a malicious file that gets loaded during normal operation. See the Palo Alto Networks CVE-2026-0299 Advisory for vendor-confirmed technical details.
Attack Vector
Exploitation requires local access and low privileges on the endpoint. The attacker does not need user interaction beyond the normal execution flow of the privileged GlobalProtect service. Once a crafted payload is placed in a writable path consulted by the service, it executes with SYSTEM on Windows or root on macOS and Linux. This vector is common in post-compromise scenarios where an initial foothold is escalated to full host control.
No verified public exploit code is available at the time of publication. Refer to the vendor advisory for technical specifics.
Detection Methods for CVE-2026-0299
Indicators of Compromise
- Unexpected executable or library files placed in directories referenced by GlobalProtect privileged processes.
- Child processes of the GlobalProtect service running with SYSTEM or root context that spawn shells, scripting interpreters, or administrative utilities.
- New scheduled tasks, launch daemons, or systemd units created shortly after GlobalProtect process activity.
Detection Strategies
- Monitor privileged GlobalProtect processes for anomalous file loads from user-writable paths.
- Alert on process lineage where the GlobalProtect service parents a command shell, PowerShell, or interpreter such as python or bash.
- Baseline the installation directory contents and flag additions or modifications by non-administrative users.
Monitoring Recommendations
- Enable file integrity monitoring on GlobalProtect installation and working directories across Windows, macOS, and Linux.
- Collect and retain endpoint process, file, and command-line telemetry to reconstruct escalation attempts.
- Correlate local logon events with subsequent privileged process activity to identify escalation patterns.
How to Mitigate CVE-2026-0299
Immediate Actions Required
- Apply the fixed GlobalProtect app version identified in the Palo Alto Networks CVE-2026-0299 Advisory as soon as it becomes available in your environment.
- Inventory all Windows, macOS, and Linux endpoints running GlobalProtect and prioritize systems shared by multiple users or hosting sensitive data.
- Restrict local logon rights on high-value endpoints to reduce the population of users able to exploit a local escalation flaw.
Patch Information
Palo Alto Networks has published guidance for CVE-2026-0299 in its official security advisory. Consult the Palo Alto Networks CVE-2026-0299 Advisory for the list of fixed versions per platform and for any vendor-recommended configuration changes. Deploy the vendor-fixed release through your standard endpoint management tooling and verify version compliance across the fleet.
Workarounds
- Remove write permissions from non-administrative users on any directory referenced by GlobalProtect privileged components.
- Enforce application allowlisting so unsigned or unexpected binaries cannot execute from user-writable locations.
- Limit interactive local access on servers and shared workstations until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
