CVE-2026-0324: GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows (Severity: MEDIUM)
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.4822 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App for Windowsto a version that resolves this vulnerability.Fixed in 6.2.8-h4Patch 6.2.8-317 - Upgrade
Upgrade
Palo Alto Networks GlobalProtect App for Windowsto a version that resolves this vulnerability.Fixed in 6.3.3-h3Patch 6.3.3-711 - Upgrade
Upgrade
OPSWAT MetaDefender Endpoint Security SDK for Windowsto a version that resolves this vulnerability.Fixed in 4.3.4822
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A locally authenticated Windows user who does not have administrative privileges can exploit it. Remote, unauthenticated attackers are not described as being able to use this issue.
What level of access could exploitation provide?
Successful exploitation can elevate the local user's privileges to NT AUTHORITY\SYSTEM on the affected Windows device.
Which deployments are in scope?
The issue affects Windows devices using the OPSWAT MetaDefender Endpoint Security SDK through the Palo Alto Networks GlobalProtect app. The provided information does not identify affected SDK or app versions, or whether all default installations are affected.