CVE-2026-0296

UNKNOWN 0.0

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome OS is not affected.

CWE	CWE-295
Vendor	palo alto networks
Product	globalprotect app
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for palo alto networks globalprotect app

Be the first to know when new unknown vulnerabilities affecting palo alto networks globalprotect app are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Palo Alto Networks / GlobalProtect App

6.3.0 < 6.3.3-h15 6.2.0 6.0.0 < 6.0.15

Palo Alto Networks / GlobalProtect App

6.3.0 < 6.3.3-h14 6.2.0 < 6.2.8-h13 6.0.0 < 6.0.15

Palo Alto Networks / GlobalProtect App

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.paloaltonetworks.com: https://security.paloaltonetworks.com/CVE-2026-0296

Credits

our internal security research teams