This vulnerability (CVE-2026-0251) involves multiple local privilege escalation issues in the Palo Alto Networks GlobalProtect app due to an untrusted search path (CWE-426). A local user with limited privileges can execute arbitrary commands with elevated privileges (NT AUTHORITY\SYSTEM on Windows, root on macOS and Linux). The affected versions are 6.0.0, 6.2.0, and 6.3.0 on desktop platforms; mobile and UWP apps are unaffected. The CVSS 4.0 vector indicates low attack complexity and no user interaction required, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows a local attacker to gain full administrative privileges on affected systems, potentially leading to complete system compromise. This elevates the attacker's capabilities from a limited user to SYSTEM/root level, enabling arbitrary command execution with the highest privileges. However, exploitation requires local access, and no remote exploitation is indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Palo Alto Networks vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to trusted individuals and monitor for suspicious local activity. Do not assume mobile or UWP versions are affected, as they are not vulnerable. Follow Palo Alto Networks' updates for any forthcoming patches or mitigations.