Palo Alto Networks GlobalProtect App ActiveX Control Execution Vulnerability on Windows

A vulnerability exists in the Palo Alto Networks GlobalProtect app for Windows, allowing remote attackers to execute ActiveX controls as if they were authenticated users. This exploitation requires the user to visit a malicious website during the GlobalProtect SAML login process. The vulnerability is not present in the GlobalProtect app on non-Windows platforms.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the affected user's system, potentially allowing the attacker to perform actions as a legitimate user.

Remediation

Users can upgrade to GlobalProtect App versions 6.3.3 or later, 6.2.5 or later, 6.1.6 or later, or 6.0.11 or later on Windows. For GlobalProtect App on macOS, Linux, iOS, Android, or the UWP version, no action is needed.