CVE-2025-0141 — Untrusted Search Path in Palo Alto Networks Globalprotect APP

CWE-426 — Untrusted Search Path5 documents5 sources
Severity
8.4HIGHNVD
EPSS
0.1%
top 76.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Globalprotect APPPaloalto Globalprotect APPPaloalto Globalprotect UWP APP
Timeline
PublishedJul 9
Latest updateJul 10

Description

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Affected Packages3 packages

▶CVEListV5palo_alto_networks/globalprotect_app6.3.0 — 6.3.3-h1 (6.3.3-c650)+4

🔴Vulnerability Details

2
GHSA
GHSA-xvp4-4cr4-vjqg: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative use↗2025-07-10
▶
CVEList
GlobalProtect App: Privilege Escalation (PE) Vulnerability↗2025-07-09
▶

📋Vendor Advisories

1
Palo Alto
GlobalProtect App: Privilege Escalation (PE) Vulnerability↗
▶
CVE-2025-0141 — Untrusted Search Path in Palo | cvebase