Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-0249
PUBLISHED
More InfoOfficial Page
Assigner-palo_alto
Assigner Org ID-d6c1279f-00f6-4ef7-9217-f89ffe703ec0
View Known Exploited Vulnerability (KEV) details
Published At-13 May, 2026 | 18:32
Updated At-15 May, 2026 | 09:57
Rejected At-
▼CVE Numbering Authority (CNA)
GlobalProtect App: Certificate Validation Bypass Vulnerabilities

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

Affected Products
Vendor
Palo Alto Networks, Inc.Palo Alto Networks
Product
GlobalProtect App
Platforms
  • macOS
Default Status
unaffected
Versions
Affected
  • From 6.3.0 before 6.3.3-h9 (6.3.3-999) (custom)
    • -> unaffectedfrom6.3.3-h9 (6.3.3-999)
  • From 6.2.0 before 6.2.8-h10 (6.2.8-948) (custom)
    • -> unaffectedfrom6.2.8-h10 (6.2.8-948)
Vendor
Palo Alto Networks, Inc.Palo Alto Networks
Product
GlobalProtect App
Platforms
  • Android
  • ChromeOS
Default Status
unaffected
Versions
Affected
  • From 6.1.0 before 6.1.13 (custom)
    • -> unaffectedfrom6.1.13
  • From 6.0.0 before 6.0.14 (custom)
    • -> unaffectedfrom6.0.14
Vendor
Palo Alto Networks, Inc.Palo Alto Networks
Product
GlobalProtect App
Platforms
  • macOS
Default Status
unaffected
Versions
Affected
  • From 6.0.0 before 6.0.13 (custom)
    • -> unaffectedfrom6.0.13
Vendor
Palo Alto Networks, Inc.Palo Alto Networks
Product
GlobalProtect App
Platforms
  • Windows
  • Linux
  • iOS
  • Windows UWP
Default Status
unaffected
Versions
Unaffected
  • All (custom)
Problem Types
TypeCWE IDDescription
CWECWE-295CWE-295 Improper Certificate Validation
Type: CWE
CWE ID: CWE-295
Description: CWE-295 Improper Certificate Validation
Metrics
VersionBase scoreBase severityVector
4.04.9MEDIUM
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Version: 4.0
Base score: 4.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-94CAPEC-94 Adversary in the Middle (AiTM)
CAPEC ID: CAPEC-94
Description: CAPEC-94 Adversary in the Middle (AiTM)
Solutions

Version Minor Version Suggested Solution GlobalProtect App 6.1 on Android 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on Android 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect App 6.1 on Chrome OS 6.1.0 through 6.1.12 Upgrade to 6.1.13 or later. GlobalProtect App 6.0 on Chrome OS 6.0.0 through 6.0.13 Upgrade to 6.0.14 or later. GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h8 Upgrade to 6.3.3-h9 (6.3.3-999) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (6.2.8-948) or later. GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.12 Upgrade to 6.0.13 or later. GlobalProtect App on Windows No action needed. GlobalProtect App on Linux No action needed. GlobalProtect App on iOS No action needed. GlobalProtect App on UWP No action needed.

Configurations

The issue is applicable to the GlobalProtect app on macOS only if SAML authentication with an embedded browser is enabled (https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-external-authentication/set-up-saml-authentication/enable-default-browser-for-saml-authentication-using-client-authentication-settings). No special configuration is required for the GlobalProtect app on Android/Chrome OS to be affected by this issue.

Workarounds

No known workarounds exist for this issue.

Exploits

Palo Alto Networks is not aware of any malicious exploitation of these issues.

Credits
other
Palo Alto Networks thanks Kakao Corp. Service Security Team and our internal security research teams for discovering and reporting this issue.
Timeline
EventDate
Initial publication.2026-05-13 16:00:00
Event: Initial publication.
Date: 2026-05-13 16:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://security.paloaltonetworks.com/CVE-2026-0249
vendor-advisory
Hyperlink: https://security.paloaltonetworks.com/CVE-2026-0249
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found