Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

CVE Database V5

GCVE Database

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

globalprotect

CVE-2026-0251 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app versions 6.0.0, 6.2.0, and 6.3.0 on Windows, macOS, and Linux. It allows a local non-administrative user to escalate privileges to SYSTEM on Windows or root on macOS and Linux by exploiting an untrusted search path issue. Mobile and UWP versions of the app are not affected. The vulnerability has a CVSS 4.

This vulnerability (CVE-2026-0251) involves multiple local privilege escalation issues in the Palo Alto Networks GlobalProtect app due to an untrusted search path (CWE-426). A local user with limited privileges can execute arbitrary commands with elevated privileges (NT AUTHORITY\SYSTEM on Windows, root on macOS and Linux). The affected versions are 6.0.0, 6.2.0, and 6.3.0 on desktop platforms; mobile and UWP apps are unaffected. The CVSS 4.0 vector indicates low attack complexity and no user interaction required, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Detailed information about CVE-2026-0251: CWE-426 Untrusted Search Path in Palo Alto Networks GlobalProtect App affecting Palo Alto Networks GlobalProtect App. 

CVE-2026-0251: CWE-426 Untrusted Search Path in Palo Alto Networks GlobalProtect App - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-0251: CWE-426 Untrusted Search Path in Palo Alto Networks GlobalProtect App

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.

The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

CVE-2025-2179 is a vulnerability identified in the Palo Alto Networks GlobalProtect App specifically on Linux devices, affecting versions 6.0.0, 6.1.0, and 6.2.0. The vulnerability is classified as CWE-266, which relates to incorrect privilege assignment. This flaw allows a locally authenticated user with non-administrative privileges to disable the GlobalProtect VPN client despite configuration settings that should prevent such an action. The vulnerability does not affect GlobalProtect versions on other operating systems such as Windows, macOS, iOS, Android, Chrome OS, or the UWP app. The CVSS v4.0 base score is 6.8, indicating a medium severity level. The attack vector is local (AV:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). The attacker must have low privileges (PR:L) but does not require authentication (AT:N) beyond local access. The impact is primarily on availability (VA:H) with no impact on confidentiality or integrity. The vulnerability allows an attacker to disrupt VPN connectivity by disabling the app, potentially circumventing security policies enforced via GlobalProtect. There are no known exploits in the wild, and no patches have been linked yet. The vulnerability is significant because GlobalProtect is widely used for secure remote access, and disabling it could expose internal networks to unauthorized access or data exfiltration if other controls are weak. The vulnerability is limited to local users on Linux devices, which somewhat restricts the attack surface but remains a concern in environments where Linux endpoints are used for remote access.

Detailed information about CVE-2025-2179: CWE-266: Incorrect Privilege Assignment in Palo Alto Networks GlobalProtect App affecting Palo Alto Networks GlobalPro

CVE-2025-2179: CWE-266: Incorrect Privilege Assignment in Palo Alto Networks GlobalProtect App - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-2179: CWE-266: Incorrect Privilege Assignment in Palo Alto Networks GlobalProtect App


CVE-2026-0251: CWE-426 Untrusted Search Path in Palo Alto Networks GlobalProtect AppCVE-2026-0251 0 CVE-2026-0251 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app versions 6.0.0, 6.2.0, and 6.3.0 on Windows, macOS, and Linux. It allows a local non-administrative user to escalate privileges to SYSTEM on Windows or root on macOS and Linux by exploiting an untrusted search path issue. Mobile and UWP versions of the app are not affected. The vulnerability has a CVSS 4. MediumVulnerability#cve #cve-2026-0251 #cwe-426 Join the discussion	CVE Database V5	05/13/2026, 18:20:01 UTC Added: 05/13/2026, 18:36:36 UTC
CVE-2025-2179: CWE-266: Incorrect Privilege Assignment in Palo Alto Networks GlobalProtect AppCVE-2025-2179 0 An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-2179 #cwe-266 Join the discussion	CVE Database V5	07/29/2025, 17:15:08 UTC Added: 07/29/2025, 17:32:54 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional