Palo Alto Networks Vulnerabilities and Affected Products
Vulnerabilities associated with GlobalProtect UWP App.
Products
Clear product- PAN-OS189 vulnerabilities
- Prisma Access112 vulnerabilities
- Cloud NGFW104 vulnerabilities
- GlobalProtect App38 vulnerabilities
- Cortex XDR Agent24 vulnerabilities
- Expedition12 vulnerabilities
- Prisma Access Agent12 vulnerabilities
- Cortex XSOAR11 vulnerabilities
- GlobalProtect UWP App9 vulnerabilities
- Prisma Browser9 vulnerabilities
- Cortex XDR Broker VM8 vulnerabilities
- Panorama7 vulnerabilities
- Prisma Cloud Compute4 vulnerabilities
- Global Protect Agent3 vulnerabilities
- Trust Protection Foundation3 vulnerabilities
- Autonomous Digital Experience Manager2 vulnerabilities
- Bridgecrew Checkov2 vulnerabilities
- Checkov by Prisma Cloud2 vulnerabilities
- Palo Alto Networks Expedition2 vulnerabilities
- Palo Alto Networks PAN-OS2 vulnerabilities
- Prisma Access Browser2 vulnerabilities
- Prisma SD-WAN ION2 vulnerabilities
- Traps2 vulnerabilities
- ActiveMQ Content Pack1 vulnerability
- Broker VM1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-0267MEDIUM | GlobalProtect App: Information Exposure Vulnerability on macOSAn information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so. CWE-532Jun 10, 2026 | CVSS4.4v4.0 | EPSS0.104% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-0250MEDIUM | GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or GatewayA buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected. CWE-787May 13, 2026 | CVSS5.2v4.0 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-2179MEDIUM | GlobalProtect App: Non Admin User Can Disable the GlobalProtect AppAn incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. CWE-266Jul 29, 2025 | CVSS6.8v4.0 | EPSS0.127% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0141HIGH | GlobalProtect App: Privilege Escalation (PE) VulnerabilityAn incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. CWE-426Jul 9, 2025 | CVSS8.4v4.0 | EPSS0.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0140MEDIUM | GlobalProtect App: Non Admin User Can Disable the GlobalProtect AppAn incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. CWE-266Jul 9, 2025 | CVSS6.8v4.0 | EPSS0.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0135MEDIUM | GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect AppAn incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. CWE-266May 14, 2025 | CVSS5.2v4.0 | EPSS0.122% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0120HIGH | GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityA vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit. CWE-250Apr 11, 2025 | CVSS7.1v4.0 | EPSS0.152% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0118MEDIUM | GlobalProtect App: Execution of Unsafe ActiveX Control VulnerabilityA vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) … CWE-618Mar 12, 2025 | CVSS6.0v4.0 | EPSS0.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0117HIGH | GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityA reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected. CWE-807Mar 12, 2025 | CVSS7.1v4.0 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |