## Summary
Palo Alto Networks GlobalProtect™ contains local privilege escalation vulnerabilities (CWE-426) that can allow a local user to escalate privileges to NT AUTHORITY\SYSTEM on Windows and to root on macOS and Linux, enabling arbitrary command execution with administrative privileges. Palo Alto Networks states it is not aware of malicious exploitation and that no workarounds are known.
## Technical Details
- The issue is a local privilege escalation affecting the GlobalProtect app on desktop operating systems.
- No special configuration is required for the product to be affected.
- Palo Alto Networks indicates there is no known workaround.
## Affected
- paloaltonetworks globalprotect versions 6.0.0 through 6.0.15 (exclusive)
- The vendor advisory content also includes Linux CPEs for multiple GlobalProtect app versions (e.g., 6.0.12, 6.0.13, 6.0.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.6, 6.2.7, 6.2.8-*, 6.2.9, 6.3.0, 6.3.1, 6.3.2, 6.3.3).
- iOS, Android, and Chrome OS are explicitly stated as not affected.
## Impact
- A non-administrative local user may escalate privileges to administrative/root-level accounts.
- This can result in arbitrary command execution with administrative privileges.
## Mitigation
1. Patch immediately to a fixed GlobalProtect version (use the vendor’s remediation guidance from the advisory).
2. Restrict local user access to endpoints running GlobalProtect to reduce the chance of a local attacker triggering the escalation.
3. Monitor for suspicious local activity consistent with privilege escalation attempts (no specific detection indicators were provided in the supplied references).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-426