CVE-2025-4232: GlobalProtect: Authenticated Code Injection Through Wildcard on macOS (Severity: MEDIUM)
Published Jun 11, 2025
·Updated
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
Affected Software
12 affected componentsFixes available
Palo Alto Networks Globalprotect Macos>=6.0.0<6.2.8
Palo Alto Networks Globalprotect Macos>=6.3.0<6.3.3
All of the following
Palo Alto Networks GlobalProtect App<6.3.3, =6.3, <6.2.8-h2 [6.2.8-c243], =6.2.0, =6.1.0, <6.0.12, =6.0.0
6.3.36.2.8-h2 [6.2.8-c243]6.0.12
Apple macOS*
All of the following
Palo Alto Networks GlobalProtect App
Microsoft Windows*
All of the following
Palo Alto Networks GlobalProtect App
Linux Linux*
All of the following
Palo Alto Networks GlobalProtect App
Google Android*
All of the following
Palo Alto Networks GlobalProtect App
Apple iOS*
Remediation
Mitigation
No workaround or mitigation is available.
Information
VERSION MINOR VERSION SUGGESTED SOLUTION
GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.2 Upgrade to 6.3.3 or later.
GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-223 Upgrade to 6.2.8-c243 or later.
GlobalProtect App 6.1 on macOS Upgrade to 6.2.8-c243or 6.3.3 or later.
GlobalProtect App 6.0 on macOS Upgrade to 6.2.8-c243 or 6.3.3 or later.
GlobalProtect App on Windows No action needed.
GlobalProtect App on Linux No action needed.
GlobalProtect App on Android No action needed.
GlobalProtect App on iOS No action needed.
GlobalProtect App on Chrome OS No action needed.
Event History
Jun 11, 2025
Advisory Published
via Palo Alto Networks·04:00 PM
Data Sourced
via Palo Alto Networks·04:00 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 12, 2025
CVE Published
via MITRE·11:22 PM
Data Sourced
via MITRE·11:22 PM
DescriptionWeakness
Jun 13, 2025
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Jul 16, 2025
Advisory Published
via Palo Alto Networks·07:00 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-4232?
CVE-2025-4232 is a high severity vulnerability due to its potential to allow privilege escalation to root by non-administrative users.
2
How do I fix CVE-2025-4232?
To fix CVE-2025-4232, update the Palo Alto Networks GlobalProtect App to versions 6.3.3 or 6.2.8-h2 or later.
3
What systems are affected by CVE-2025-4232?
CVE-2025-4232 specifically affects the Palo Alto Networks GlobalProtect App running on macOS.
4
Who can exploit CVE-2025-4232?
CVE-2025-4232 can be exploited by non-administrative users who have access to the log collection feature.
5
What type of vulnerability is CVE-2025-4232?
CVE-2025-4232 is classified as an improper neutralization of wildcards vulnerability.