CVE-2025-0117

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

En bref

Sévérité: HIGH 7.1
EPSS: EPSS 0.16 % · centile 6 (2026-10-27)
État: PUBLISHED
Publiée: 2025-03-12
Mise à jour: 2026-02-26
Attribuée par: palo_alto
Statut NVD: Deferred

Description

A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 7.1	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto
CVSS 4.0	HIGH 7.1	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber	NVD · psirt@paloaltonetworks.com (Secondary)

Faiblesses (CWE)

CWE-807

Références européennes

ENISA EUVD · EUVD-2025-7351
GCVE · GCVE-0-2025-0117

Avis du CERT-FR

CERTFR-2025-AVI-0204 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
Palo Alto Networks · GlobalProtect App	affected 6.3.0 < 6.3.3 ; affected 6.2.0 < 6.2.6 ; affected 6.1.0 < 10.2.14 ; affected 6.0.0 < 10.1.14-h11
Palo Alto Networks · GlobalProtect App	unaffected All < 6.3.3
Palo Alto Networks · GlobalProtect UWP App	unaffected All

Références

https://security.paloaltonetworks.com/CVE-2025-0117

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD