RCE in Palo Alto Networks Globalprotect App
CVE-2026-0298
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitr…
Vulnerability class: RCE (Remote Code Execution)
Affected products
- Palo Alto Networks Globalprotect App — versions 6.3.0, 6.2.0, 6.0.0
Weakness classification (CWE)
References
- psirt@paloaltonetworks.com (vendor-advisory)