--- title: Critical Vulnerability in Palo Alto Networks GlobalProtect VPN description: A critical security vulnerability has been identified in Palo Alto Networks' GlobalProtect VPN application, affecting macOS, Linux, and Windows systems. --- [Skip to content](https://1898advisories.burnsmcd.com/critical-vulnerability-in-palo-alto-networks-globalprotect-vpn#main-content) ![1898-logo-grey-R-1](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898-logo-grey-R-1.webp?width=188&height=100&name=1898-logo-grey-R-1.webp) - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) Open main navigation Close main navigation - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) - [Contact us](https://1898andco.burnsmcd.com/contact-us) [Contact us](https://1898andco.burnsmcd.com/contact-us) July 14, 2025 # Critical Vulnerability in Palo Alto Networks GlobalProtect VPN ![Picture of The 1898 & Co. Team](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898%20Cyberthreat%20Advisory%20Blog%20Assets/1898-Co-Ampersand.png?width=50&name=1898-Co-Ampersand.png) [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) A critical security vulnerability has been identified in Palo Alto Networks' GlobalProtect VPN application, affecting macOS, Linux, and Windows systems. This flaw allows locally authenticated users to escalate their privileges to root access on macOS and Linux, or NT AUTHORITY\\SYSTEM on Windows. The vulnerability, classified as an incorrect privilege assignment flaw, poses significant risks for organizations using this popular enterprise VPN solution. It affects multiple versions of the GlobalProtect app, enabling non-administrative users with local access to gain complete administrative control. The vulnerability has been assigned a CVSS score of 8.4 under the base scoring system, indicating a medium severity level with moderate urgency for remediation. It is categorized as a CWE-426 Untrusted Search Path weakness, typically involving applications loading resources from insecure locations that attackers can manipulate. Notably, GlobalProtect applications on iOS, Android, Chrome OS, and the GlobalProtect UWP app are not affected by this issue. Palo Alto Networks has emphasized that no special configuration is required for systems to be vulnerable, meaning all default installations of affected versions are at risk. The company has provided specific upgrade paths for each platform and version combination, urging organizations to implement these updates immediately. While there are no known malicious exploitations of this vulnerability in the wild, the potential for privilege escalation attacks necessitates prompt patching efforts. #### Threats and Vulnerabilities The identified vulnerability in Palo Alto Networks' GlobalProtect VPN application is a privilege escalation flaw that allows locally authenticated users to gain root or system-level access. This type of attack could enable malicious actors to install unauthorized software, modify system configurations, access sensitive data, or establish persistent backdoors on compromised systems. The vulnerability affects multiple versions of the GlobalProtect app across Windows, macOS, and Linux platforms. The CVSS score of 8.4 highlights the medium severity of this vulnerability, with a significant potential impact on affected systems. The flaw is categorized as a CWE-426 Untrusted Search Path weakness, which involves applications loading resources from insecure locations that attackers can manipulate. This vulnerability impacts several major versions of GlobalProtect, with specific upgrade paths recommended for each platform and version combination. #### Client Impact Clients using Palo Alto Networks' GlobalProtect VPN may face operational disruptions if the identified vulnerability is exploited. Potential impacts include unauthorized access to sensitive data, installation of malicious software, and modification of critical system configurations. These actions could lead to data breaches, financial losses, and damage to an organization's reputation. From a compliance perspective, failure to address this vulnerability could result in regulatory challenges or penalties if sensitive data is compromised. Organizations should prioritize patching efforts to mitigate these risks and maintain their security posture. #### Mitigations To mitigate the risks associated with the identified vulnerability in GlobalProtect VPN, clients should take the following actions: 1. Upgrade all affected versions of GlobalProtect on macOS and Windows to version 6.3.3-h1 (6.3.3-c650) or later. 2. Update GlobalProtect version 6.2 on macOS and Windows to 6.2.8-h2 (6.2.8-c243) or later. 3. For Linux users, upgrade to version 6.2.8 or later as soon as the fix becomes available. 4. Ensure all installations of GlobalProtect versions 6.1 and 6.0 are updated to the latest patched versions. 5. Regularly review and apply security patches for all software applications to reduce exposure to vulnerabilities. 6. Immediate software updates are crucial as no workarounds or mitigations are available for this vulnerability. Organizations should prioritize these updates to prevent potential privilege escalation attacks and maintain their security posture. #### 1898 & Co. Response 1898 & Co. is actively addressing the current threat landscape by offering tailored solutions to help clients mitigate emerging threats like the GlobalProtect VPN vulnerability. Our team provides expert guidance on implementing necessary software updates and enhancing overall security measures. We are updating our security protocols and practices to incorporate the latest threat intelligence and ensure our clients are well-protected against potential exploits. Our collaborative efforts with industry partners and government agencies enable us to stay ahead of evolving threats and provide timely support to our clients. Our ongoing research and threat intelligence gathering activities allow us to offer insights into emerging vulnerabilities and recommend effective mitigation strategies. We encourage clients to engage with our services for further assistance in implementing recommended security measures and maintaining a robust security posture. #### Sources 1. [Palo Alto Networks GlobalProtect Vulnerability Disclosure](https://security.paloaltonetworks.com/CVE-2025-0141) 2. [CVE Details for GlobalProtect VPN Vulnerability](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0141) [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) *The information in this cybersecurity advisory is provided "as is" for informational purposes only. 1898 & Co. does not provide any warranties or guarantees of any kind regarding this information. You assume all risks if you choose to rely on this information. In no event shall 1898 & Co. or its contractors or subcontractors be liable for any damages including, but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with, this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information* *1898 & Co. does not endorse any product or service, except as expressly stated otherwise. Any reference to products or processes does not constitute or imply 1898 & Co.’s endorsement or recommendation.* Subscribe ✕ Close   [Accessibility](https://1898andco.burnsmcd.com/accessibility)  |  [Privacy Statement](https://1898andco.burnsmcd.com/privacy) © 2026 1898 & Co., a part of Burns & McDonnell. All Rights Reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The 1898 & Co. Team", "url" : "https://1898advisories.burnsmcd.com/author/1898-co-team" }, "dateModified" : "2026-04-30T21:05:33.533Z", "datePublished" : "2025-07-14T14:24:08.000Z", "headline" : "Critical Vulnerability in Palo Alto Networks GlobalProtect VPN", "mainEntityOfPage" : { "@id" : "https://1898advisories.burnsmcd.com/critical-vulnerability-in-palo-alto-networks-globalprotect-vpn", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "//cdn2.hubspot.net/hub/477837/file-2585615236-jpg/Logo_1_Primary_2Color1.jpg" }, "name" : "Burns & McDonnell Engineering Co" } } ```