Globalprotect App
Monthly
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the confidentiality and integrity impacts are rated High given successful interception enables full visibility and manipulation of application traffic outside the VPN tunnel.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or uninstalling the endpoint agent - to unprivileged local users. A local user who reads the exposed passcode can then bypass endpoint protection controls that are specifically designed to prevent such actions, effectively disabling Palo Alto's endpoint security enforcement on the affected machine. No public exploit exists at time of analysis, and CVSS 4.0 supplemental metrics classify exploitation likelihood as 'Unreported' (E:U), though the impact on security posture is significant given that the passcode mechanism is the primary access control preventing users from circumventing GlobalProtect.
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-the-middle attacks from locally adjacent network positions, enabling traffic interception and malicious software installation. The flaw allows an unauthenticated attacker on the same subnet - or a local non-administrative OS user - to redirect encrypted VPN communications to a rogue server by bypassing TLS certificate checks. No public exploit has been identified at time of analysis, EPSS is effectively zero, and CISA SSVC rates exploitation as none, though the high confidentiality and integrity impact on the vulnerable component warrants prompt patching on affected platforms.
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker positioned as a man-in-the-middle to corrupt memory during Portal/Gateway message processing, potentially executing arbitrary code with SYSTEM privileges on affected endpoints. Affected platforms include Windows (including the UWP variant), macOS, and other non-iOS clients; iOS is explicitly excluded by the vendor. No public exploit identified at time of analysis - EPSS stands at 0.01% and SSVC confirms no current exploitation - however the SSVC technical impact rating of 'total' and potential for full SYSTEM-level compromise justify prioritized patching for endpoints connecting from untrusted networks.
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a low-privileged local user to elevate to NT AUTHORITY\SYSTEM (Windows) or root (macOS/Linux), enabling full OS-level command execution. The root cause is CWE-426 (Untrusted Search Path), where the application resolves executables or libraries from attacker-controllable locations. No public exploit has been identified and CISA SSVC confirms exploitation status as none; however, SSVC rates technical impact as total, reflecting the complete privilege gain achievable upon successful exploitation.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the confidentiality and integrity impacts are rated High given successful interception enables full visibility and manipulation of application traffic outside the VPN tunnel.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
GlobalProtect app on macOS exposes administrator-configured passcodes - used to restrict disabling, disconnecting, or uninstalling the endpoint agent - to unprivileged local users. A local user who reads the exposed passcode can then bypass endpoint protection controls that are specifically designed to prevent such actions, effectively disabling Palo Alto's endpoint security enforcement on the affected machine. No public exploit exists at time of analysis, and CVSS 4.0 supplemental metrics classify exploitation likelihood as 'Unreported' (E:U), though the impact on security posture is significant given that the passcode mechanism is the primary access control preventing users from circumventing GlobalProtect.
Improper certificate validation in Palo Alto Networks GlobalProtect App exposes macOS and Android users to adversary-in-the-middle attacks from locally adjacent network positions, enabling traffic interception and malicious software installation. The flaw allows an unauthenticated attacker on the same subnet - or a local non-administrative OS user - to redirect encrypted VPN communications to a rogue server by bypassing TLS certificate checks. No public exploit has been identified at time of analysis, EPSS is effectively zero, and CISA SSVC rates exploitation as none, though the high confidentiality and integrity impact on the vulnerable component warrants prompt patching on affected platforms.
Buffer overflow in Palo Alto Networks GlobalProtect App (versions 6.0 through 6.3) allows an adjacent-network attacker positioned as a man-in-the-middle to corrupt memory during Portal/Gateway message processing, potentially executing arbitrary code with SYSTEM privileges on affected endpoints. Affected platforms include Windows (including the UWP variant), macOS, and other non-iOS clients; iOS is explicitly excluded by the vendor. No public exploit identified at time of analysis - EPSS stands at 0.01% and SSVC confirms no current exploitation - however the SSVC technical impact rating of 'total' and potential for full SYSTEM-level compromise justify prioritized patching for endpoints connecting from untrusted networks.
Local privilege escalation vulnerabilities in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow a low-privileged local user to elevate to NT AUTHORITY\SYSTEM (Windows) or root (macOS/Linux), enabling full OS-level command execution. The root cause is CWE-426 (Untrusted Search Path), where the application resolves executables or libraries from attacker-controllable locations. No public exploit has been identified and CISA SSVC confirms exploitation status as none; however, SSVC rates technical impact as total, reflecting the complete privilege gain achievable upon successful exploitation.