GlobalProtect CVE-2026-0307 affects specified Palo Alto Networks GlobalProtect versions on Windows, macOS and Linux. Palo Alto Networks says a local low-privileged user on an affected endpoint could escalate privileges to NT AUTHORITYSYSTEM on Windows or root on macOS and Linux, allowing commands to run with administrative privileges.
Full remediation has two parts: administrators need to check both the affected GlobalProtect app and the applicable PAN-OS or Prisma Access environment. Palo Alto Networks currently lists staged client-fix ETAs of September 17, September 28 and October 29, 2026, depending on the branch and operating system. An ETA in the advisory should not be treated as proof that a build is already downloadable; administrators should verify actual availability before relying on it.
Which platforms are affected by GlobalProtect CVE-2026-0307?
Palo Alto Networks identifies affected GlobalProtect versions on Windows, macOS and Linux. The vendor says iOS, Android and ChromeOS are not affected by this CVE.
The published attack vector is local rather than remote. The issue requires a local user with low privileges on an affected endpoint; Palo Alto Networks does not describe CVE-2026-0307 as an unauthenticated internet-exploitable vulnerability.
What can CVE-2026-0307 allow?
On a vulnerable system, a local low-privileged user may be able to execute arbitrary commands with elevated rights. Palo Alto Networks describes the resulting privilege as SYSTEM on Windows and root on macOS or Linux.
This makes the vulnerability relevant to enterprise endpoint security even though an attacker already needs local low-privilege access. The risk is privilege escalation from a restricted local account to administrative control.
Which GlobalProtect fixes should administrators check?
The required target release depends on the GlobalProtect branch and operating system. Palo Alto Networks currently identifies 6.3.3-h15, 6.2.8-h14 and 6.0.15 as fixed target builds for applicable affected clients, but its advisory still presents availability through platform-specific ETAs.
Upgrade to 6.3.3-h15 or later. Palo Alto Networks currently shows an ETA of September 17, 2026. Verify that the build is actually available before treating the endpoint as patchable to that target.
Upgrade to 6.3.3-h15 or later. The vendor currently shows a September 28, 2026 ETA for these platforms.
Upgrade to 6.2.8-h14 or later. Palo Alto Networks currently shows a September 28, 2026 ETA for the corrected build on these platforms.
Upgrade to 6.0.15 or later. The current advisory shows September 28 ETAs for Linux and macOS and an October 29 ETA for Windows.
Administrators should verify the current Palo Alto Networks advisory and software-download availability before upgrading. A fixed-version number and its ETA identify the remediation target, but an ETA alone does not establish that the package has shipped.
Is updating the GlobalProtect client enough?
No. Palo Alto Networks explicitly says fixing this vulnerability also requires the applicable PAN-OS software or Prisma Access tenant to reach the relevant fixed version.
An endpoint can therefore reach its corrected client target while the overall environment still requires backend remediation. The reverse is also true: upgrading PAN-OS or Prisma Access does not prove that affected endpoint clients have reached their fixed versions.
Which PAN-OS versions fix CVE-2026-0307?
Palo Alto Networks provides branch-specific PAN-OS remediation targets rather than one universal fixed release. Its current solution matrix includes PAN-OS 12.2.3 or later for affected 12.2 releases and PAN-OS 12.1.10 or later as one remediation path for affected 12.1 releases, with additional fixed maintenance releases for particular 12.1 and 11.2 branches.
Administrators should compare the exact PAN-OS branch and installed build with the vendor’s current solution table because the correct fixed release depends on the branch.
What should Prisma Access customers check?
Palo Alto Networks says Prisma Access tenants also need the relevant backend upgrade. The vendor says Prisma Access customers will be upgraded during the next scheduled maintenance cycle, while customers requiring an earlier upgrade should contact Palo Alto Networks Support or their account team to arrange an on-demand software upgrade window.
A Prisma Access customer should therefore verify both the endpoint client version and the tenant’s backend remediation state before considering CVE-2026-0307 fully addressed.
How do I know whether my environment is fully remediated?
Confirm whether the endpoint runs Windows, macOS or Linux. Palo Alto Networks says iOS, Android and ChromeOS are not affected by this CVE.
Compare the installed client against the vendor’s current affected-version and solution matrix for that operating system.
Do not treat a listed ETA as proof of availability. Confirm the applicable fixed build is available before planning the endpoint upgrade around it.
Verify the applicable backend is also on a vendor-defined fixed version or remediation state. Client-only remediation is not sufficient.
The next broad client milestone in the current advisory is September 28, when multiple macOS, Windows and Linux fixed builds are scheduled.
Is there a workaround?
Palo Alto Networks says there is no known workaround for CVE-2026-0307. Where a fixed client release for a particular operating system or branch is still pending, administrators should follow the vendor’s staged release schedule and backend remediation guidance rather than relying on an unsupported configuration workaround.
Is CVE-2026-0307 actively exploited?
Palo Alto Networks currently says it is not aware of malicious exploitation of CVE-2026-0307. That is the vendor’s current evidence state and can change if new exploitation information emerges.
What happens next?
The next verified broad remediation checkpoint is September 28, 2026. Palo Alto Networks currently lists that date as the ETA for GlobalProtect 6.3.3-h15 on macOS and Windows, 6.2.8-h14 on macOS and Windows, and 6.0.15 on Linux and macOS.
The Windows GlobalProtect 6.0 branch has a later October 29, 2026 ETA for 6.0.15. Administrators should also recheck the advisory sooner if Palo Alto Networks changes a release ETA, publishes new remediation guidance or changes its exploitation statement.
Verification note: The current Palo Alto Networks CVE-2026-0307 advisory identifies the affected platforms, fixed-version targets, staged client-release ETAs, PAN-OS and Prisma Access remediation requirements, workaround status and current exploitation status. Administrators should verify actual software availability rather than interpreting an ETA as confirmation that a client build has shipped.