This vulnerability (CVE-2026-0267) involves the insertion of sensitive information, specifically configured passcodes, into log files by the GlobalProtect app on macOS. A local attacker with limited privileges can read these logs to obtain passcodes that control disabling, disconnecting, or uninstalling the app. With these passcodes, the attacker can circumvent configuration restrictions and perform these actions unauthorized. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with local access to the affected macOS system can obtain sensitive passcodes from log files, enabling them to disable, disconnect, or uninstall the GlobalProtect app regardless of configuration restrictions. This could undermine endpoint security controls enforced by the app, potentially exposing the system to further compromise or loss of VPN connectivity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to the affected system and monitor for unauthorized attempts to disable or uninstall the GlobalProtect app. Avoid exposing log files containing sensitive information to untrusted users.