CVE-2022-0016

HIGH

Palo Alto Networks GlobalProtect 5.2 < 5.2.9 - Local Privilege Escalation via Connect Before Logon

Title source: llm

Description

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://security.paloaltonetworks.com/CVE-2022-0016

Scores

CVSS v3 7.4

EPSS 0.0021

EPSS Percentile 10.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-755 CWE-703

Status published

Products (1)

paloaltonetworks/globalprotect 5.2 - 5.2.9

Published Feb 10, 2022

Tracked Since Feb 18, 2026