Palo Alto GlobalProtect macOS Info Disclosure Vulnerability CVE-2026-0267 Advisory

Vulnerability Overview CVE ID: CVE-2026-0267 Vulnerability Name: GlobalProtect App: Information Exposure Vulnerability on macOS Severity Level: Moderate Impact Severity: Moderate CVSS Score: 4.4 Description: A vulnerability in the Palo Alto Networks GlobalProtect application on macOS allows local users to retrieve the configuration password used to disable, disconnect, or uninstall the GlobalProtect app. Once the password is obtained, users can perform these operations even if the configuration prohibits such actions. Affected Versions Affected Versions: - GlobalProtect App 6.3: = 6.3.3-h1 on macOS - GlobalProtect App 6.2: >= 6.2.8-h2 on macOS Other Platforms: Windows, Linux, iOS, Android, and Chrome OS are not affected Remediation Recommended Solution: - GlobalProtect App 6.3 on macOS: Upgrade to version 6.3.3-h1 or later - GlobalProtect App 6.2 on macOS: Upgrade to version 6.2.8-h2 or later Workaround: - In the GlobalProtect Portal configuration on PAN-OS firewalls or Panorama, set "Allow users to uninstall the GlobalProtect app" to "Deny". Additional Information Publication Date: 2026-06-11 Update Date: 2026-06-11 Discovery Status: Discovered in production environments Exploitation Status: Palo Alto Networks has not observed any malicious exploitation of this vulnerability Weakness Type: CWE-532 Insertion of Sensitive Information into Log File, CAPEC-155 Use of Screen Scraping for Sensitive Information CPEs cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3::::::: cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2::::::: CPE Applicability cpe:2.3:a:palo_alto_networks:globalprotect_app::::::::macOS:: from (inclusive) 6.3.3 to (exclusive) 6.3.3-h1 is vulnerable OR cpe:2.3:a:palo_alto_networks:globalprotect_app::::::::macOS:: from (inclusive) 6.2.8 to (exclusive) 6.2.8-h2 is vulnerable Timeline 2026-06-11: Initial release --- The above is a summary of key vulnerability information extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Palo Alto GlobalProtect macOS Info Disclosure Vulnerability CVE-2026-0267 Advisory