Is CVE-2026-0249 actively exploited?

No active exploitation of CVE-2026-0249 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-0249 be exploited remotely?

Partially. CVE-2026-0249 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-0249?

CVE-2026-0249 has a CVSS score of 4.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-0249

MEDIUM

CVE-2026-0249

CWE-295Published: May 13, 2026· Updated: May 14, 2026

4.9

CVSS v3.1

EPSS:0.00%probability of exploitation in 30 daysPercentile:0.2th

Official Description

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software.

The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

NVD Source

Technical Analysis

CVE-2026-0249 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber