GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

Why this deserves its current priority

CVSS is 4.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Palo Alto Networks/GlobalProtect App (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Palo Alto Networks/GlobalProtect App.
2. 2Review the reported fix. Update Palo Alto Networks/GlobalProtect App to 6.3.3-h14 (6.3.3-1121) if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 13, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 10, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 13, 2026

Sources and claim methodology

• Source referencesecurity.paloaltonetworks.com

Related CVEs

• Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerSame generic ecosystem
• Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflowSame generic ecosystem
• coollabsio Coolify GitHub App Setup redirect missing authenticationSame generic ecosystem
• Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainerSame generic ecosystem
• Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix MatchingSame generic ecosystem
• AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profileSame generic ecosystem