Attack Chain

1. An attacker establishes a position as a man-in-the-middle between the client machine running the vulnerable GlobalProtect app and the gateway or update server.
2. The attacker intercepts TLS-protected communication initialization requests initiated by the GlobalProtect application.
3. The attacker presents a fraudulent or self-signed certificate to the GlobalProtect client application during the TLS handshake process.
4. The GlobalProtect application fails to perform rigorous certificate validation, improperly trusting the attacker-supplied certificate.
5. The TLS connection is successfully established between the victim client and the attacker-controlled proxy.
6. The attacker performs interception and modification of application-level data packets passing through the proxy.
7. The attacker forwards modified traffic to the legitimate destination or consumes sensitive application metadata, effectively compromising the integrity of the communication channel.

Impact

Successful exploitation could allow an attacker to perform man-in-the-middle attacks, enabling the interception and modification of application communications. While the vulnerability does not directly impact the encrypted VPN tunnel traffic, the compromise of secondary communications could lead to unauthorized data disclosure or potential manipulation of application settings or configuration updates. No specific victim sectors have been identified, as the issue is a software-level defect affecting a broad range of enterprise endpoints.

Recommendation

1. Prioritize the deployment of patches provided by Palo Alto Networks for all affected versions of the GlobalProtect App.
2. For GlobalProtect 6.3 on Linux, ensure systems are updated to version 6.3.3-h15 or later.
3. For GlobalProtect 6.2 on macOS and Windows, upgrade to 6.2.8-h13 (6.2.8-1045) or later.
4. For GlobalProtect 6.0 across all platforms, upgrade to 6.0.15 or later.
5. Audit network environment for anomalous proxy activity or unexpected TLS interception occurring on endpoints where GlobalProtect is installed.

This vulnerability is significant for organizations relying on GlobalProtect for secure access, as it enables lateral movement and persistence if an attacker has already gained initial low-privileged access to an endpoint. Palo Alto Networks reports that the vulnerability was discovered internally and there is currently no evidence of malicious exploitation in the wild. Affected versions include various branches of 6.0, 6.2, and 6.3. Defenders should prioritize patching, as no workarounds are available to mitigate the underlying search path issue.

Impact

Successful exploitation of CVE-2026-0299 allows a local user, regardless of their original privilege level, to gain full control over the affected system. This facilitates the bypass of security controls, unauthorized access to sensitive data stored on the endpoint, and the potential for persistent backdoors to be installed at the OS kernel or system level. Given the broad deployment of GlobalProtect in enterprise environments, the potential blast radius for an attacker with local access is high.

Recommendation

Prioritize the deployment of patches provided by Palo Alto Networks across the enterprise fleet.

• Update all GlobalProtect Windows and macOS instances to at least 6.3.3-h14 or 6.2.8-h13.
• For GlobalProtect version 6.0, update all instances to version 6.0.15 or later.
• Audit endpoint security logs for unexpected child processes spawned by GlobalProtect binaries, which may indicate testing or exploitation of the service path.