CVE-2026-0298

CVE-2026-0298 is an improper input validation flaw in the Windows GlobalProtect Pre-Logon Access Provider (PLAP). This component runs as SYSTEM and handles network connectivity before any user authentication or TLS handshake — it establishes VPN connectivity during the Windows pre-login phase. An attacker positioned between the client and VPN gateway can inject malformed network input that the privileged PLAP process trusts without validation, leading to SYSTEM-level code execution via man-in-the-middle. The CVSS 3.1 score of 5.2 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures exploitability constraints but significantly understates operational impact. The combination of pre-authentication network position, SYSTEM-level privileges, and the component's role as a bootstrap chokepoint for enterprise connectivity means any vulnerability here has a blastradius exceeding what the numeric rating suggests. In practice, this is a high-severity finding in any environment where an adversary can occupy a network position between GlobalProtect clients and gateways — the very scenario VPN deployments are meant to protect against. Linux, macOS, iOS, Android, and ChromeOS are explicitly unaffected. The platform asymmetry indicates the vulnerable code path exists only in the Windows build, likely a divergent implementation track that didn't receive the same security scrutiny as other platform builds. This pattern — parallel privileged code paths accumulating unexamined assumptions — is well-documented in pre-authentication network components: SMB, LDAP, and RADIUS clients have all exhibited identical vulnerabilities where developers extended post-authentication trust assumptions to pre-authentication code paths. Prioritize patching Windows GlobalProtect immediately. Beyond this specific CVE, treat other Windows-specific privileged networking components in the GlobalProtect stack as higher-sensitivity targets for security review. The presence of a vulnerability in one Windows-only code path suggests others may exist in similarly unexamined Windows build branches.

Reviewed through automated stages and approved by a human before publication.