Detection work for a local privilege escalation rarely produces a dramatic alert. No hostile request appears in a web log, and no inbound connection arrives from a strange ASN. The signal lives in versions, in process ancestry, and in the gap between what the endpoint claims to run and what it actually runs. CVE-2026-0315, a local escalation to root in the GlobalProtect app for macOS published by Palo Alto Networks on 14 October 2026, is a good excuse to build that signal properly.

What you are hunting for

Three questions decide whether a Mac carries the exposure. Is the GlobalProtect app installed? Which build is it? Is the build inside the affected ranges?
The advisory names macOS builds 6.2.0 through 6.2.8-h14 and 6.3.0 through 6.3.3-h15 as affected, with fixes at 6.2.8-h15 (build 6.2.8-1084) and 6.3.3-h16 (build 6.3.3-1199). It also states that Windows, Linux, iOS, Android and Chrome OS clients are unaffected, so a hunt that pulls all GlobalProtect records without a platform filter will waste analyst time on machines that cannot carry the bug.

Step one: read the bundle, not the installer

Installer packages and cached downloads misrepresent what is actually running. Query the live bundle. On macOS the short version string sits in /Applications/GlobalProtect.app/Contents/Info.plist, and a managed fleet can usually collect it through the same agent that runs compliance checks. Record the raw string, the platform, the collection time and the device identifier. Raw strings matter because the hotfix suffix appears in two notations, and a hunt that stores only a normalised number cannot explain later why a device vanished from the report.

Step two: look for user-level copies

An administrator-grade install lands in /Applications. A user who installed the client themselves, or a machine that once ran a personal copy, may also hold a bundle under a home directory. Enumerate both locations. A stale bundle in a user directory is not automatically exploitable, but it is a version your patch report does not see, and that is exactly the kind of blind spot an attacker prefers.

Step three: check process ancestry after an alert

Once a host is known to run an affected build, the interesting question becomes whether anything has already tried to cross the boundary. A successful chain ends with a process running as root whose parent, shortly before, was an ordinary user session. Review the local account activity, look for elevation events that were not part of a scheduled maintenance window, and correlate with the endpoint security telemetry you already collect. The advisory does not publish exploit mechanics, so do not hunt for a single signature and consider the job done; hunt for the outcome the bug produces.

Step four: write the exception list

Machines outside both ranges need a decision, not silence. Builds older than 6.2.0 are outside the published scope and are also outside the vendor's support assessment. Label them unsupported, keep them on the rebuild list, and do not let them inherit the clean status of a properly fixed host.

Step five: quantify what is reachable

Internet telemetry answers a different question from endpoint inventory. For this advisory two ZoomEye queries were executed and stored with the source record: the product search app="GlobalProtect" returned 612 matching assets, and the CVE filter vul.cve="CVE-2026-0315" returned 0. Exposure is taken as the larger of the two, so 612.
Read those numbers with care. A product fingerprint counts hosts that present GlobalProtect characteristics to a scanner. It does not establish the operating system, the installed build, or a vulnerable client. A zero on the CVE filter means the identifier is not yet indexed, which is unremarkable for an advisory published days earlier. Both figures are useful for trend tracking and for arguing that a population exists worth managing. Neither figure is a vulnerability count, and a report that presents 612 as "affected hosts" will be wrong in a way that survives long after the patch window closes.

Turning the hunt into a control

The durable output here is a recurring check rather than a one-time list. It is a weekly check that answers one question in a machine-readable way: how many macOS endpoints run a GlobalProtect build inside the affected ranges? When that number is visible, the patch campaign has a denominator, the risk register has evidence, and the next advisory in the same product line starts with a query instead of a scramble.

Sources

  • Palo Alto Networks security advisory, CVE-2026-0315: https://security.paloaltonetworks.com/CVE-2026-0315

  • CVE.org record for CVE-2026-0315: https://www.cve.org/CVERecord?id=CVE-2026-0315

  • CERT-FR advisory CERTFR-2026-AVI-1326: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1326/

  • ZoomEye product query app="GlobalProtect": 612 matching assets, recorded 2026-10-22

  • ZoomEye CVE filter vul.cve="CVE-2026-0315": 0 matching assets, recorded 2026-10-22