PT-2026-40773 · Palo Alto Networks · Globalprotect

Published 2026-05-13 · Updated 2026-05-17 · CVE-2026-0249

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app (affected versions not specified)

Description Improper certificate validation allows an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative operating system user or an attacker on the same subnet can redirect traffic to an unauthorized server, which may facilitate the installation of malicious software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2026-07046

CVE-2026-0249

Affected Products

Globalprotect

References · 5

• https://security.paloaltonetworks.com/CVE-2026-0249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0249 · Security Note
• https://bdu.fstec.ru/vul/2026-07046 · Security Note
• https://twitter.com/VulmonFeeds/status/2054745115990675513 · Twitter Post
• https://twitter.com/f1tym1/status/2055931215715213372 · Twitter Post