What is the CVSS score of CVE-2025-4232?

CVE-2025-4232 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of macOS are affected by CVE-2025-4232?

CVE-2025-4232 affects Palo Alto Networks GlobalProtect for macOS, allowing non-administrative users to escalate privileges to root through a log collection feature flaw.. A patch is available.

How to fix or mitigate CVE-2025-4232?

Within 24 hours: Identify all macOS endpoints running GlobalProtect and their current versions using endpoint inventory tools. Within 7 days: Apply the vendor-released patch to all affected GlobalProtect installations on macOS systems (consult Palo Alto Networks advisory for specific patched version numbers). Within 30 days: Conduct audit logs review for any sign of privilege escalation attempts targeting GlobalProtect log collection features on macOS systems.

macOS CVE-2025-4232

EUVD-2025-18224 HIGH

Improper Neutralization of Wildcards or Matching Symbols (CWE-155)

2025-06-13 psirt@paloaltonetworks.com

Privilege Escalation macOS Paloalto Globalprotect Paloaltonetworks

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.2.8-h2,6.3.3

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18224

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.

AnalysisAI

CVE-2025-4232 is an improper neutralization of wildcards vulnerability in Palo Alto Networks GlobalProtect app for macOS that allows non-administrative users to escalate privileges to root through the log collection feature. With a CVSS score of 8.8 and requiring only low complexity remote network access with low privileges, this vulnerability presents a critical privilege escalation risk. The attack requires user interaction only at the network level (not UI) and affects the confidentiality, integrity, and availability of affected systems.

Technical ContextAI

The vulnerability resides in the log collection feature of GlobalProtect for macOS, where inadequate input validation on wildcard characters (CWE-155: Improper Neutralization of Wildcards or Matching Operators) allows privilege escalation. The underlying issue involves insufficient sanitization of special characters used in glob patterns or shell commands within the logging subsystem. This likely occurs when log collection parameters are processed without proper escaping or validation before being passed to system commands or file operations. The GlobalProtect application operates as a VPN client and security gateway component on macOS, with potential CPE coverage including palo_alto_networks:globalprotect and potentially macos as the affected platform. The log collection feature typically runs with elevated privileges to capture system-level security logs, creating a pathway for privilege escalation when an unprivileged user can influence the parameters used in this privileged operation.

RemediationAI

Immediate remediation steps: (1) Consult the official Palo Alto Networks Security Advisory (referenced URL typically found at security.paloaltonetworks.com) for the specific patched version number; (2) Update GlobalProtect app to the latest available patch version via the official Palo Alto Networks software repository or app store; (3) Prioritize patching on systems where non-administrative users have access, as privilege escalation requires low-privilege user context; (4) Until patching is feasible, implement access controls to restrict log collection feature invocation to trusted administrative users only, though this may impact application functionality; (5) Monitor system logs and audit trails for suspicious privilege escalation attempts or unexpected root-level process spawning from GlobalProtect; (6) Verify patch installation by checking the GlobalProtect version in system settings and confirming against the security advisory baseline.