Security1 hOctober 22, 2026, 14:22

CVE-2026-0315: Detecting macOS GlobalProtect Local Privilege Escalation

Palo Alto Networks disclosed CVE-2026-0315, a local privilege escalation to root in the GlobalProtect app on macOS (CVSS v4.0: AV:L, PR:L, UI:N). With no exploit mechanics published, detection relies on behavioural signals: version drift below 6.2.8-h15 and 6.3.3-h16, unexplained elevation events, new privileged artefacts and user-level client copies outside /Applications.

DEV Community

Open source

CVE-2026-0315: Detecting macOS GlobalProtect Local Privilege Escalation

Affected builds are below 6.2.8-h15 and 6.3.3-h16
CVSS v4.0: AV:L, PR:L, UI:N, AC:L, high CIA impact
ZoomEye: 612 hosts matching app="GlobalProtect", 0 for the CVE filter
Detection relies on behaviour rather than exploit signatures

#PaloAltoNetworks#GlobalProtect#macOS

Nix and Lix fix local root privilege-escalation flaws

Security

ZcopyReaper: A Local Privilege Escalation in the Linux Kernel RDS Path

Security

ReliaQuest: Qilin and Settra enter networks via GlobalProtect without credentials

Security

CVE-2026-0315: Detecting macOS GlobalProtect Local Privilege Escalation

Nix and Lix fix local root privilege-escalation flaws

ZcopyReaper: A Local Privilege Escalation in the Linux Kernel RDS Path

ReliaQuest: Qilin and Settra enter networks via GlobalProtect without credentials

MarkLogic privilege escalation chain reaches database admin from query access