VulnSocial

CVE-2026-0307Active Exploitation

MEDIUMCVSS 5.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-426

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-09-11); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-11: 1Mentions · 2026-10-18: 1Active Exploitation · 2026-09-11: 1Patch / Workaround · 2026-10-18: 1Technical Details · 2026-10-18: 109-1110-18
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-111
Active Exploitation1
2026-10-181
Patch1
Full discourse2 posts
  • multilayer@multilayer
    Patch

    Palo Alto NetworksがGlobalProtectアプリのCVE-2026-0307の修正バージョンを更新した（米国時間10/17）。 ローカルの一般ユーザーが、WindowsではSYSTEM、macOSとLinuxではrootの権限を取れてしまう問題で、iOS・Android・ChromeOS向けは影響しないとのこと。 修正バージョンは、Windows・macOSが6.3.3-h16または6.2.8-h15以降、Linuxが6.3.3-h15以降で、6.0系の6.0.15は10/29に提供予定とのこと。 アプリだけでなくPAN-OSやPrisma Accessも更新しないと修正が完了しない点に注意したい。 悪用は確認されておらず、回避策もないとのこと。 VPNのクライアントは利用者の端末に広く入っているので、アプリとファイアウォールの両方を確認しておくと抜けが防げる。 #PaloAltoNetworks #GlobalProtect #脆弱性 https://security.paloaltonetworks.com/CVE-2026-0307

    Post summary

    The text reports Palo Alto Networks releasing patched versions for CVE-2026-0307, a local privilege escalation vulnerability in GlobalProtect, with specific fix versions listed and confirmation that no exploitation has been observed.

    0000076
    813 followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    Some increased actor activities are shown targeting Palo Alto Networks GlobalProtect App (CVE-2026-0307) https://vuldb.com/vuln/401954/cti

    Post summary

    The post reports that threat actors are increasingly targeting CVE-2026-0307 in Palo Alto Networks GlobalProtect, suggesting real‑world exploitation, but provides no PoC, patch, or technical details.

    00000147
    2.3K followersView on X

Explore more

Back to dashboard