[NEW] [high] Palo Alto Networks GlobalProtect App: Multiple vulnerabilities

highCVE-2026-0295 CVE-2026-0296 CVE-2026-0297 CVE-2026-0298 CVE-2026-0299

An attacker can exploit multiple vulnerabilities in Palo Alto Networks GlobalProtect App to gain administrator privileges, execute arbitrary code with administrator privileges, bypass security measures, manipulate and disclose data as well as trigger a Denial-of-Service condition.

CSIRTS triage

vendor: Palo Alto Networks product: GlobalProtect App Privilege escalation Remote code execution Authentication bypass Code injection Information disclosure

What: Multiple vulnerabilities in GlobalProtect App allow attackers to gain administrator privileges, execute arbitrary code, bypass security measures, and cause denial of service.
Who is affected: GlobalProtect App deployments of unspecified versions are affected.
Urgency: High urgency; privilege escalation and code execution capabilities pose critical risk to endpoint security.
Action: Update GlobalProtect App to a version patching CVE-2026-0295 through CVE-2026-0299 immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GlobalProtect App

Get an email when a new GlobalProtect App advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2804

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-02950.08% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-02960.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-02970.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-02980.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-02990.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0295	coverage & exploitation status	NVD · CVE.org
CVE-2026-0296	coverage & exploitation status	NVD · CVE.org
CVE-2026-0297	coverage & exploitation status	NVD · CVE.org
CVE-2026-0298	coverage & exploitation status	NVD · CVE.org
CVE-2026-0299	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.