GlobalProtect, Release Notes, Build Numbers, CVE ?!?!

TonyDeHart — Wed, 20 May 2026 12:17:15 GMT

Can someone explain to me why the GlobalProtect App release notes don't list the CVE's addressed? These are changes made in the app that need to be in the release notes and it seems unnecessary to have to check two different sources for information.

The only place CVE's are listed for GlobalProtect seems to be here: https://security.paloaltonetworks.com/

Also, what is it with Palo Alto and seemingly Cisco too with 6.3.3-h10 being listed but then on other locations being listed with a build # such as c1011. Either call it one or the other but not both. The security site lists h11 now for a CVE that was showing 6.3.3-h10 the other day but since it isn't in any release notes it appears no one is being notified of this. If I hadn't checked today I'd have though deploying 6.3.3-h10 was going to fix https://security.paloaltonetworks.com/CVE-2026-0251 .

Sorry this is a bit of a rant so this is mainly intended for Palo Alto but good grief lets get some consistency. If you want to use both numbers use them both everywhere.

topic GlobalProtect, Release Notes, Build Numbers, CVE ?!?! in GlobalProtect Discussions

GlobalProtect, Release Notes, Build Numbers, CVE ?!?!