CVE-2026-0298CWE-94code-injection

CVE-2026-0298

High · published August 13, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
25.5
In the wild
Unconfirmed
What it is

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.

The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-13T07:16Z
Affected products (27)
ProductVersionsFixed in
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotect≥ 6.0.0, < 6.0.156.0.15
paloaltonetworks/globalprotect≥ 6.2.0, < 6.2.86.2.8
paloaltonetworks/globalprotect≥ 6.3.0, < 6.3.36.3.3
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
paloaltonetworks/globalprotectall versions—
References (1)
https://security.paloaltonetworks.com/CVE-2026-0298 · [email protected]
EPSS history
Timeline
  • 13 AUG 02:02Z
    GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)
    cvelistv5