CVEvulnerability

CVE-2026-0249

4.9 MEDIUM Published 2026-05-13 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
4.9 MEDIUM — CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295

Description

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

Affected configurations

• paloaltonetworks globalprotect (>= 6.0.0 < 6.0.13) • paloaltonetworks globalprotect (>= 6.0.0 < 6.0.14) • paloaltonetworks globalprotect (>= 6.1.0 < 6.1.14) • paloaltonetworks globalprotect (>= 6.2.0 < 6.2.8) • paloaltonetworks globalprotect (>= 6.3.0 < 6.3.3) • paloaltonetworks globalprotect 6.2.8 • paloaltonetworks globalprotect 6.3.3

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References