CVE-2026-0296 is an improper certificate validation vulnerability in the Palo Alto Networks GlobalProtect app that allows an unauthenticated attacker with man-in-the-middle capabilities to intercept and modify application communications. This vulnerability does not affect VPN tunnel traffic and does not impact the GlobalProtect app on iOS, Android, or Chrome OS.