High severity · published Mar 12, 2025
CVE-2025-0117
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
GlobalProtect App · Palo Alto Networks
6.3.0 before 6.3.3; 6.2.0 before 6.2.6; 6.1.0 before 10.2.14; 6.0.0 before 10.1.14-h11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0117
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0117
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-0117
More from GlobalProtect App
8.0
CVE-2025-0118
GlobalProtect App: Execution of Unsafe ActiveX Control Vulnerability
7.8
CVE-2024-9473
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
7.0
CVE-2025-0120
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
3.3
CVE-2025-0135
GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App