This vulnerability (CVE-2026-0267) involves the insertion of sensitive information (passcodes) into log files by the Palo Alto Networks GlobalProtect app on macOS. A local attacker with limited privileges can access these logs to retrieve passcodes that control disabling, disconnecting, or uninstalling the app. This exposure allows the attacker to circumvent intended security controls configured in the app. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). Affected versions explicitly include 6.2.0 and 6.3.0. The CVSS 4.0 vector indicates local attack vector, low complexity, no user interaction, and partial impact on confidentiality and availability. No vendor advisory or patch is currently available, and no exploits are known in the wild.

An attacker with local access to a macOS system running the affected GlobalProtect app versions can obtain sensitive passcodes from log files. This enables the attacker to disable, disconnect, or uninstall the GlobalProtect app despite configuration restrictions, potentially weakening endpoint security controls. The impact is limited to local users and does not involve remote exploitation. The confidentiality of the passcodes is compromised, and availability of the GlobalProtect app can be affected by unauthorized disabling or uninstalling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to systems running the affected GlobalProtect app versions to trusted personnel only. Monitor for any updates from Palo Alto Networks regarding patches or mitigations. Avoid storing or exposing sensitive passcodes in logs or accessible files as a best practice once a fix is applied.