← CVE Intelligence

CVE-2026-0296

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability PUBLISHED

Description (CNA)

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome OS is not affected.

Affected (CNA)

Vendor / productVersions
Palo Alto Networks / GlobalProtect Appaffected 6.3.0 before 6.3.3-h15; affected 6.2.0; affected 6.0.0 before 6.0.15
Palo Alto Networks / GlobalProtect Appaffected 6.3.0 before 6.3.3-h14; affected 6.2.0 before 6.2.8-h13; affected 6.0.0 before 6.0.15
Palo Alto Networks / GlobalProtect Appunaffected All

CWE

CWE-295

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.