Recently modified vulnerabilities for "palo alto networks globalprotect windows" 6.3.0

Where

AND

Sort:

Palo Alto Networks GlobalProtectGlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway

Risk 75

Severity

7.7

Buffer Overflow

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway.

The GlobalProtect app on iOS is not affected.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-0250

Palo Alto Networks GlobalProtect (Windows)GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: HIGH)

Risk 73

Severity

8.5

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

First published (updated )

CVE-2026-0251

Palo Alto Networks Globalprotect WindowsGlobalProtect App: Local Privilege Escalation (PE) Vulnerability (Severity: LOW)

Risk 53

Severity

7.8

EPSS

0.04%

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber

A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect.

Remedy

This issue is fixed in GlobalProtect app 6.2.5, and will be fixed in the remaining supported versions of GlobalProtect app listed in the Product Status section. Updates will be published to this advisory as they become available. Customers who want to upgrade should reach out to customer support at https://support.paloaltonetworks.com .

Remedy

Update the Windows registry on endpoints with an affected version of GlobalProtect to disable all MSI installations (not just GlobalProtect installations). This change is system-wide, so it will affect all users of the system including administrators. The following command will update the registry on an endpoint to disable the repair functionality of any MSI file. It will also prevent using MSI files to install, re-install, or uninstall software. This command must be run with administrative privileges. reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 2 /f Be aware that this will fully prevent use of all MSI files, thereby blocking common IT operations such as software deployments typically done by endpoint management solutions that use MSI files to perform the installations. Use caution before updating this value in the registry. After setting DisableMSI to 2, this value will need to be either deleted or changed to another value in order to use any MSI files. For more information, please see https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi.

Remedy

This issue is fixed in GlobalProtect app 6.0.10-c823, GlobalProtect app 6.1.4-c720, GlobalProtect app 6.2.5, GlobalProtect app 6.3.1-c383, and will be fixed in the remaining supported versions of GlobalProtect app listed in the Product Status section. Updates will be published to this advisory as they become available. Customers who want to upgrade should reach out to customer support at https://support.paloaltonetworks.com.

First published (updated )

CVE-2024-9473

Palo Alto Networks Globalprotect WindowsGlobalProtect App: Local Privilege Escalation (PE) Vulnerability (Severity: MEDIUM)

Risk 72

Severity

7.8

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber

A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.

Remedy

This issue is fixed in GlobalProtect app 5.1.x (ETA: December 2024), GlobalProtect app 6.0.x (ETA: November 2024), GlobalProtect app 6.1.5, GlobalProtect app 6.2.4, GlobalProtect app 6.3.1 (ETA: end of August), and all later GlobalProtect app versions on Windows.

Remedy

Ensure that the GlobalProtect installation directory and its contents cannot be modified by non-administrative Windows users.

Remedy

This issue is fixed in GlobalProtect app 5.1.x (ETA: December 2024), GlobalProtect app 6.0.10-c826, GlobalProtect app 6.1.5, GlobalProtect app 6.2.4, GlobalProtect app 6.3.1, and all later GlobalProtect app versions on Windows.

First published (updated )

CVE-2024-5915

Trending

Palo Alto Networks GlobalProtectGlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway

Palo Alto Networks GlobalProtect (Windows)GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: HIGH)

Palo Alto Networks Globalprotect WindowsGlobalProtect App: Local Privilege Escalation (PE) Vulnerability (Severity: LOW)

Remedy

Remedy

Remedy

Palo Alto Networks Globalprotect WindowsGlobalProtect App: Local Privilege Escalation (PE) Vulnerability (Severity: MEDIUM)

Remedy

Remedy

Remedy

Company

Resources

Contact