Riskcovery

CVE-2025-2183

GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation

State
Published
Severity
5.3 Medium
Published
Aug 13, 2025
Updated
Feb 26, 2026
Reserved
Mar 10, 2025

Read the record on cve.org

Description

An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amberpalo_alto

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
GlobalProtect AppPalo Alto Networks
  • 6.3.0 to before 6.3.3-h2 (6.3.3-c676)Affectedfrom 6.3.3-h2 (6.3.3-c676)Not affected
  • 6.2.0 to before 6.2.8-h3 (6.2.8-c263)Affectedfrom 6.2.8-h3 (6.2.8-c263)Not affected
  • 6.1.0Affected
  • 6.0.0Affected
GlobalProtect AppPalo Alto Networks
  • 6.3.0 to before 6.3.3Affectedfrom 6.3.3Not affected
  • 6.2.0 to before 11.1.10Affectedfrom 11.1.10Not affected
  • 6.1.0Affected
  • 6.0.0Affected
GlobalProtect AppPalo Alto Networks
  • AllNot affected
Global Protect UWP AppPalo Alto Networks
  • AllNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.