CVE-2026-0298
Last modified
CVE-2026-0298 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Globalprotect | >= 6.0.0, < 6.0.15 |
| Paloaltonetworks | Globalprotect | >= 6.2.0, < 6.2.8 |
| Paloaltonetworks | Globalprotect | >= 6.3.0, < 6.3.3 |
| Paloaltonetworks | Globalprotect | 6.0.15 |
| Paloaltonetworks | Globalprotect | 6.2.8 |
| Paloaltonetworks | Globalprotect | 6.3.3 |
References
- https://security.paloaltonetworks.com/CVE-2026-0298Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-0298?
How severe is CVE-2026-0298?
How do I fix CVE-2026-0298?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-0292An authentication bypass vulnerability in the network driver…6
- CVE-2026-0293A vulnerability in Palo Alto Networks Prisma® Access Agent o…6
- CVE-2026-0294A privilege escalation (PE) vulnerability in the Palo Alto N…7.8
- CVE-2026-0295A race condition in the Palo Alto Networks GlobalProtect™ cl…7
- CVE-2026-0296Improper certificate validation vulnerabilities in Palo Alto…7.4
- CVE-2026-0297A buffer overflow vulnerability exists in the Palo Alto Netw…8.1
- CVE-2026-0299Local privilege escalation vulnerabilities in the Palo Alto …7.8
- CVE-2026-0300A buffer overflow vulnerability in the User-ID™ Authenticati…9.8
- CVE-2026-0301An information disclosure vulnerability in the URL Filtering…7.5
- CVE-2026-0302An OS command injection vulnerability in Palo Alto Networks …1.1
- CVE-2026-0303A code execution vulnerability in Palo Alto Networks Checkov…2.4
- CVE-2026-0304A privilege escalation vulnerability in Palo Alto Networks C…4.8
Are you affected by CVE-2026-0298?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST