CVE-2026-0314: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in Palo Alto Networks GlobalProtect App

This vulnerability (CVE-2026-0314) involves type confusion in the Palo Alto Networks GlobalProtect app on Windows. Type confusion occurs when a program accesses a resource using an incompatible type, potentially leading to unexpected behavior. In this case, a local user with low privileges can exploit the flaw to cause a denial of service (DoS) condition, disrupting the application's availability. The issue is limited to the Windows version of the GlobalProtect app; other supported platforms are not impacted. The vulnerability has been assigned a medium severity level with a CVSS 4.0 vector indicating local attack vector, low complexity, no user interaction, and high impact on availability.

The impact of this vulnerability is a denial of service (DoS) condition caused by a local user with low privileges on the Windows GlobalProtect app. This could disrupt VPN connectivity or related services, affecting availability. There is no indication of privilege escalation, data disclosure, or remote exploitation. Other platforms are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Palo Alto Networks advisories for updates and apply patches once available. Until then, restricting local access and monitoring for unusual activity may help mitigate risk.