Palo Alto Networks GlobalProtect App Privilege Escalation Vulnerability on Windows

A privilege escalation vulnerability has been identified in the OPSWAT MetaDefender Endpoint Security SDK, which is used by the Palo Alto Networks GlobalProtect app on Windows. This vulnerability allows a locally authenticated non-administrative user to escalate privileges to NT AUTHORITY\SYSTEM. However, exploiting this vulnerability requires successfully navigating a race condition, making it challenging to execute.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation to the NT AUTHORITY\SYSTEM account.

Remediation

Users can upgrade to GlobalProtect App version 6.3.3 or later, 6.2.8 or later, or for versions 6.1 and 6.0, to 6.2.8 or later or 6.3.3 or later. Instructions for downloading the GlobalProtect App are available on the Palo Alto Networks support site.