Palo Alto GlobalProtect Has Five Ugly Bugs. One Is Still Unpatched

VPN software is supposed to create a secure path into the corporate network.

GlobalProtect has now picked up five vulnerabilities that show what happens when the software sitting on that path gets its own privilege-escalation problems.

The issues affect Palo Alto Networks’ GlobalProtect application on Windows, macOS and Linux. Two were fixed under CVE-2026-0251, while a separate disclosure describes additional weaknesses, including one that remains unpatched.

• The Mess: Security researcher Martijn van Ramesdonk disclosed five GlobalProtect flaws, including local privilege-escalation bugs that can turn a low-privileged account into SYSTEM on Windows or root on macOS and Linux. One reported issue is still awaiting remediation.

The interesting part is that this is not an Internet-to-root attack.

The attacker already needs local access to the endpoint.

That sounds less scary.

It isn’t.

Once an attacker has landed on a workstation through phishing, malware, a stolen account or another vulnerability, privilege escalation is exactly what they want next.

A normal user account is inconvenient.

SYSTEM is different.

Root is different.

With those privileges, the operating system stops telling the attacker “no” quite so often.

Palo Alto’s own advisory confirms that CVE-2026-0251 covers multiple local privilege-escalation vulnerabilities in the GlobalProtect application. A local authenticated user can exploit them to execute arbitrary commands with elevated privileges.

The affected platforms are Windows, macOS and Linux.

The mobile and Chrome OS versions are not affected by these particular flaws.

That distinction matters.

Security headlines often turn “GlobalProtect vulnerability” into “all Palo Alto VPN infrastructure is compromised.”

That is not what this disclosure says.

The problem is specifically the endpoint application.

And endpoint applications are everywhere.

Corporate laptops.

Workstations.

Remote employees.

Administrators.

Developers.

People who connect from coffee shops and airports.

People who connect from machines that already have ten other applications installed.

The VPN client therefore becomes part of the endpoint’s trusted computing base.

If it can be abused to gain SYSTEM or root, attackers have another route to full machine control.

• What Actually Happened: Palo Alto Networks patched the vulnerabilities covered by CVE-2026-0251, while the researcher says additional issues were treated differently during disclosure and one remains unpatched as remediation continues.

The disclosure process itself is becoming part of the story.

According to the researcher, the investigation involved more than 40 emails with Palo Alto Networks’ product security team and several changing disclosure deadlines. He also says two additional issues were considered outside the vendor’s bug-bounty scope.

That does not change the technical risk.

But it does highlight a recurring problem with security research.

A vulnerability can be technically fixed while the public record remains incomplete.

Researchers want accurate credit.

Vendors want coordinated disclosure.

Customers want one simple answer:

Am I vulnerable, and what do I install?

That’s the part that matters most.

For CVE-2026-0251, Palo Alto’s answer is clear: update the affected GlobalProtect application to a fixed release.

The bigger concern is what happens before the attacker reaches this vulnerability.

Imagine an employee gets compromised.

The attacker lands with a standard user account.

They cannot immediately control the machine.

Then they discover GlobalProtect.

If the client contains a local privilege-escalation bug, the attacker’s problem becomes much smaller.

Low privilege becomes high privilege.

The endpoint becomes theirs.

And now the attacker can start looking for credentials, tokens, browser data, files, network access and other machines.

That’s the standard privilege-escalation playbook.

Get in.

Get higher privileges.

Stay there.

Move laterally.

• The Damage: A successful local exploit can turn a low-privileged account into SYSTEM or root, giving an attacker powerful control over the endpoint and potentially opening the door to credential theft and lateral movement.

The VPN connection makes the situation even more interesting.

A compromised corporate laptop may already have access to internal services that an ordinary Internet user cannot reach.

Internal Git servers.

File shares.

Databases.

Management portals.

Development infrastructure.

The attacker does not necessarily need another remote exploit.

The compromised endpoint is already inside.

This is why endpoint privilege escalation deserves attention even when the vulnerability is not remotely exploitable.

A CVSS score alone does not describe the entire incident chain.

Initial access can come from somewhere else.

Privilege escalation is the second act.

And second acts are often where compromises become serious.

There is another useful lesson here.

Running security software with elevated privileges is unavoidable in many cases. VPN clients need access to networking components, certificates, routing and system configuration.

But privileged software must be treated as high-value code.

It has access because it has to.

That also means a bug inside it has consequences because it can.

• The Fix: Update GlobalProtect to Palo Alto’s patched release for CVE-2026-0251, remove unnecessary local administrative privileges, and investigate endpoints for suspicious activity if vulnerable versions were deployed.

Administrators should inventory GlobalProtect versions across Windows, macOS and Linux rather than assuming every endpoint is current.

For organizations using centralized endpoint management, verify that the update actually reached remote devices.

The laptop sitting offline for three weeks is still vulnerable.

So is the developer’s Mac that somehow escaped the last software deployment.

And if an affected endpoint was already compromised, simply installing the GlobalProtect update is not enough.

Check for persistence.

Review suspicious processes.

Look for unusual administrator activity.

Inspect credential access.

Check outbound connections.

The vulnerability may have been the second step in an attack that started somewhere else.

Bugstoday Verdict: GlobalProtect is supposed to get users into the network securely. If an attacker already on the machine can turn a normal account into SYSTEM or root, the VPN client itself becomes another escalation path. Patch it. Then find out why the attacker got onto the machine in the first place.