Windows PLAP Improper Input Validation in Palo Alto GlobalProtect RCE via MitM
CVE-2026-0298 Published on August 13, 2026
GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.
The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Vulnerability Analysis
Timeline
Initial Publication
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-0298 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-0298
Want to know whenever a new CVE is published for Palo Alto Networks Globalprotect App? stack.watch will email you.
Affected Versions
Palo Alto Networks GlobalProtect App:- Version 6.3.0 and below 6.3.3-h14 is affected.
- Version 6.2.0 and below 6.2.8-h13 is affected.
- Version 6.0.0 and below 6.0.15 is affected.
- Version All is unaffected.