CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (Severity: MEDIUM)

CSIRTS triage

What

Code execution vulnerability in the Windows Pre-Logon Access Provider component allows arbitrary code execution.

Who is affected

Windows users with GlobalProtect App installed who are targeted before system logon.

Urgency

Medium to high urgency due to code execution capability and Windows pre-logon exposure.

Action

Apply Palo Alto Networks patch for GlobalProtect App CVE-2026-0298.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Palo Alto Networks Security Advisories (INTL · vendor-psirt · site)

Severity

medium

Published

2026-08-12

Exploitation

Not in CISA KEV at last sync

Original advisory: https://security.paloaltonetworks.com/CVE-2026-0298

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-02980.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownPalo Alto Products Multiple Vulnerabilitieshkcert
• high[NEW] [high] Palo Alto Networks GlobalProtect App: Multiple vulnerabilitiescert-bund
• unknownCVE-2026-0298: An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLA…nvd

Recent advisories for GlobalProtect App

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• high[NEW] [high] Palo Alto Networks GlobalProtect App: Multiple vulnerabilitiescert-bund · 2026-08-13
• unknownCVE-2026-0299: Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable …nvd · 2026-08-13
• unknownCVE-2026-0298: An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLA…nvd · 2026-08-13
• unknownCVE-2026-0297: A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enable…nvd · 2026-08-13
• unknownCVE-2026-0296: Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable…nvd · 2026-08-13
• mediumCVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (Severity: MEDIUM)paloalto · 2026-08-12

More from Palo Alto Networks Security Advisories

• highPAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)2026-08-12
• mediumCVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (Severity: MEDIUM)2026-08-12
• mediumCVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (Severity: MEDIUM)2026-08-12
• lowCVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering (Severity: LOW)2026-08-12
• mediumCVE-2026-0294 Prisma Access Agent: Local Privilege Escalation (Severity: MEDIUM)2026-08-12