CVE-2025-0120 — Execution with Unnecessary Privileges in Palo Alto Networks Globalprotect APP

CWE-250 — Execution with Unnecessary Privileges4 documents4 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 68.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Palo Alto Networks Globalprotect APPPaloaltonetworks GlobalprotectPaloalto Globalprotect APP+1 more
Timeline
PublishedApr 11

Description

A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Affected Packages4 packages

▶NVDpaloaltonetworks/globalprotect6.0.0 — 6.0.12+2
▶CVEListV5palo_alto_networks/globalprotect_app6.3.0 — 6.3.3+3

🔴Vulnerability Details

2
GHSA
GHSA-gg8q-gxm4-v22c: A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated n↗2025-04-11
▶
CVEList
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability↗2025-04-11
▶

📋Vendor Advisories

1
Palo Alto
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability↗
▶
CVE-2025-0120 — Execution with Unnecessary Privileges | cvebase