This vulnerability (CVE-2026-0299) involves an untrusted search path (CWE-426) in the Palo Alto Networks GlobalProtect app. A local user with limited privileges can exploit this flaw to execute arbitrary commands with elevated privileges (NT AUTHORITY\SYSTEM on Windows, root on macOS and Linux). The issue is limited to the desktop versions of the app (Windows, macOS, Linux) and does not impact mobile or Chrome OS versions. No official patch or remediation level has been provided by the vendor as of the published date. No known exploits are reported in the wild.

Successful exploitation allows a local user to escalate privileges to the highest system level, potentially leading to full system compromise on affected platforms. This can enable unauthorized administrative actions and control over the affected system. The vulnerability is limited to local users and does not require user interaction or network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Palo Alto Networks advisories for updates. Until a patch is available, restrict local user access to trusted users only and consider applying additional endpoint protection controls to detect suspicious privilege escalation attempts.