Palo Alto Networks PSIRT CVE-2026-0307 (published 9 September 2026, updated 23 September 2026): multiple local privilege-escalation vulnerabilities in the GlobalProtect app (CWE-426 untrusted search path) let a local low-privileged user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run arbitrary commands with administrative privileges. iOS, Android and ChromeOS are not impacted. No special configuration required.

Vendor CVSS-BT 5.9 MEDIUM (CVSS 4.0); CVSS-B 8.5; exploit maturity UNREPORTED; urgency MODERATE. Palo Alto Networks says it is not aware of malicious exploitation.

23 Sep advisory refresh: GlobalProtect 6.3.3-h15 fixed builds for Linux/macOS/Windows all show ETA 09/28 (Linux ETA previously ~17 Sep on the 16 Sep desk card); 6.2.8-h14 Win/macOS ETA 09/28; 6.0.15 Linux/macOS ETA 09/28, Windows ETA 10/29. NGFW customers must also upgrade PAN-OS / Prisma Access — Solution table now cites e.g. PAN-OS 12.2.3; 12.1.10 / 12.1.7-h6 / 12.1.4-h11; and listed 11.2/11.1/10.2 hotfixes (hotfix minor revs bumped vs 16 Sep card).

Prisma Access via scheduled maintenance or on-demand Support upgrade. Distinct from desk cards cve-2026-0299 and cve-2026-0251. Primary: Palo Alto Networks PSIRT.

UPDATE 30 Sep–3 Oct 2026 (desk 04:00 Perth 3 Oct): Palo Alto PSIRT advisory refresh dated 30 September 2026 slips GlobalProtect fixed-build ETAs — 6.3.3-h15 (Linux/macOS/Windows) and 6.2.8-h14 (macOS/Windows) now show ETA 10/06 (was 09/28 on the 23 Sep desk card); 6.0.15 remains ETA 10/29 across Linux/macOS/Windows. Severity still CVSS-BT 5.9 MEDIUM / CVSS-B 8.5; exploit maturity UNREPORTED; vendor still not aware of malicious exploitation.

NGFW/Prisma Access PAN-OS upgrade requirement unchanged. Primary: Palo Alto PSIRT CVE-2026-0307.

UPDATE 17 Oct 2026: Palo Alto Networks revised the advisory on 17 October 2026 (timeline: 'Update versions and add build numbers for 6.2.8 and 6.3.3'), and the Solution table no longer shows any ETA, so the fixed GlobalProtect builds are now listed as available. The fix target moved on Windows and macOS: 6.3.0 through 6.3.3-h15 is affected and the fix is 6.3.3-h16 (build 6.3.3-1199) or later, and 6.2.0 through 6.2.8-h14 is affected with the fix in 6.2.8-h15 (build 6.2.8-1084) or later.

Anyone who installed 6.3.3-h15 on Windows or macOS expecting it to be the fix still needs to move to 6.3.3-h16. On Linux, 6.2.0 through 6.3.3-h14 is fixed in 6.3.3-h15 (build 6.3.3-c63). On all three desktop platforms, 6.0.0 through 6.0.14 is fixed in 6.0.15. iOS, Android and ChromeOS still need no action. Severity is unchanged (CVSS-B 8.5, CVSS-BT 5.9, exploit maturity unreported), there is no workaround, and Palo Alto Networks is still not aware of malicious exploitation.

The PAN-OS and Prisma Access rows of the Solution table are unchanged.