If your VPN fleet includes Linux endpoints, check the GlobalProtect app build alongside the firewall release.
What changed November 10, 2026. Palo Alto Networks revised CVE-2026-0250, originally published May 13. The security table now lists Linux 6.3.3-h15 without an ETA, and the vendor has published release notes for that build. For 6.0 Linux and Android, 6.0.15 is listed with a 01/27 ETA. ChromeOS 6.0 lists 6.0.15 without an ETA. The vendor’s Solution table still lists earlier mobile build numbers in some rows. Use the stricter Product Status floors below and verify the package for your platform before scheduling.
A network-adjacent attacker who can intercept GlobalProtect traffic during a portal or gateway connection can disrupt the client and potentially run code as SYSTEM. Palo Alto Networks lists no special configuration requirement. Vendor severity is Medium, CVSS 4.0 base 7.7 and base plus threat 5.2. The vendor reports no known malicious exploitation or workaround. CISA KEV has no entry, so there is no federal KEV deadline.
Check platform and release branch
| Client | Affected below this build | Fixed floor in Product Status |
|---|---|---|
| Linux 6.2/6.3 (per Solution table) | 6.3.3-h15 | 6.3.3-h15 |
| Linux 6.0 | 6.0.15 | 6.0.15 (ETA 01/27) |
| Windows and macOS 6.3 / 6.2 / 6.0 | 6.3.3-h9 / 6.2.8-h10 / 6.0.13 | Same respective floors |
| Windows UWP | 6.3.3-h10 | 6.3.3-h10 |
| Android and ChromeOS 6.3 / 6.1 | 6.3.5 / 6.1.14 | Same respective floors |
| Android 6.0 / ChromeOS 6.0 | 6.0.15 | 6.0.15, with ETA 01/27 for Android |
| iOS | Unaffected | No update required for this CVE |
Pilot the client update
Suggested MSP priority is expedited for affected remote-access endpoints that routinely connect from untrusted networks. Inventory app builds by OS and branch. Where rollout must wait, use managed networks when possible as exposure reduction. If compromise is suspected, isolate the endpoint and preserve evidence. Pilot the supported client upgrade, then verify the installed version, SAML authentication and portal and gateway reconnect behavior. The vendor lists no CVE-specific compromise-check or rotation procedure.
Palo Alto Networks advisory · Linux h15 release notes · Linux h15 known issues · CISA KEV catalog data
Original vendor publication May 13, 2026. Vendor revision November 10, 2026. Last verified November 11, 2026.