The Windows GlobalProtect client belongs in the endpoint patch queue. This fix ships in the client because it replaces a bundled component.
New November 11, 2026. Palo Alto Networks published these advisories on November 11.
CVE-2026-0324 affects the OPSWAT MetaDefender Endpoint Security SDK used by GlobalProtect on Windows. A locally authenticated standard user can escalate to NT AUTHORITY\SYSTEM. Palo Alto lists no special configuration, Medium severity and Moderate urgency, with CVSS 4.0 5.9 threat-adjusted / 8.5 base.
| Component | Affected | Fixed |
|---|---|---|
| GlobalProtect for Windows 6.3 | 6.3.0 through 6.3.3-h2 | 6.3.3-h3 (6.3.3-711) or later |
| GlobalProtect for Windows 6.2 | 6.2.0 through 6.2.8-h3 | 6.2.8-h4 (6.2.8-317) or later |
| OPSWAT SDK on Windows | 4.3.0 up to, excluding, 4.3.4822 | 4.3.4822 or later |
Palo Alto lists macOS, Linux, iOS, Android and the GlobalProtect UWP app as requiring no action for this advisory. The vendor lists no workaround. Keep current supported builds that already clear the floor and preserve newer fixes.
What I’d check across customers
- Use Intune, RMM or endpoint inventory where deployed to identify Windows devices and the actual installed VPN client build.
- Prioritize shared endpoints and privileged workstations with affected builds. Follow the normal endpoint incident process if telemetry independently indicates compromise.
- Stage the supported client update in a pilot ring and deploy to the remaining affected devices.
- Confirm installed builds and test VPN sign-in, MFA and host posture checks where used.
Suggested MSP priority is prompt endpoint rollout for affected clients. Official sources CVE-2026-0324 · CISA KEV
Last verified November 11, 2026. The CVEs in this entry were absent from CISA’s KEV catalog at review. Palo Alto Networks reports no known malicious exploitation. The advisory guidance does not call for compromise checks or credential rotation.