6.0
Medium
CVE-2024-5921 An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to…
Description
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GlobalProtect App 6.2 | 6.2.0 → < 6.2.6 | 6.2.6 |
References
- security.paloaltonetworks.com security.paloaltonetworks.com
- blog.amberwolf.com blog.amberwolf.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of GlobalProtect App
The 41 CVEs of GlobalProtect App →
CVE-2026-0314
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low…
4.3
Medium
CVE-2026-0315
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate…
5.9
Medium
CVE-2026-0307
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user…
5.9
Medium
CVE-2026-0299
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to…
5.9
Medium