CVE-2026-0298 — GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

CVE-2026-0298

GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) PUBLISHED

Description (CNA)

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.

Affected (CNA)

Vendor / product	Versions
Palo Alto Networks / GlobalProtect App	affected 6.3.0 before 6.3.3-h14; affected 6.2.0 before 6.2.8-h13; affected 6.0.0 before 6.0.15
Palo Alto Networks / GlobalProtect App	unaffected All

CWE

CWE-94

References

https://security.paloaltonetworks.com/CVE-2026-0298

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.