This vulnerability (CVE-2026-0251) involves multiple local privilege escalation issues in the Palo Alto Networks GlobalProtect app due to an untrusted search path (CWE-426). A local user with limited privileges can execute arbitrary commands with elevated privileges (NT AUTHORITY\SYSTEM on Windows, root on macOS and Linux). The affected versions are 6.0.0, 6.2.0, and 6.3.0. The vulnerability does not impact mobile or UWP versions of the app. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the data, and no exploits are known in the wild.

Successful exploitation allows a local non-administrative user to gain full administrative privileges on the affected system, potentially leading to complete system compromise. This elevates the risk of unauthorized system control and execution of arbitrary commands with the highest privileges. However, the attack requires local access and no user interaction is needed. The vulnerability does not affect mobile or UWP versions of the GlobalProtect app.

Patch status is not yet confirmed — check the Palo Alto Networks vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted users only and monitor for suspicious local activity related to GlobalProtect. No vendor advisory or official patch information is provided in the current data.