GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Palo Alto Networks | GlobalProtect App | 5.2 to before 5.2.9 | 5.2.9 | Patch available | CNA |
| Palo Alto Networks | GlobalProtect App | — | — | No fix listed | CNA |
- GlobalProtect App VendorPalo Alto Networks Affected 5.2 to before 5.2.9 Fixed in 5.2.9 Patch available CNA
- GlobalProtect App VendorPalo Alto Networks Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* | 5.2 to before 5.2.9 | Vulnerable | CyberArk Software, a Palo Alto Networks Company |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* Versions 5.2 to before 5.2.9 Vulnerable ·CyberArk Software, a Palo Alto Networks Company
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA GlobalProtect App (Palo Alto Networks) Fixed in 5.2.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Palo Alto Networks GlobalProtect App 5.2.9
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-00016 GlobalProtect App: Information Exposure Vulnerability When Using Connect Before LogonPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0016
- 2026-10-03 Alias added: GHSA-mrwh-mjvv-r5vh
References
More Palo Alto Networks vulnerabilities
- TI-2024-08782 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure KEVCVSS 4.0CRITICAL 9.9
- TI-2024-03172 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01936 PAN-OS: Authentication Bypass in SAML Authentication KEVCVSS 3.1CRITICAL 10.0
- TI-2017-11675 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-00239 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal KEVCVSS 4.0CRITICAL 9.3
- TI-2024-08784 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure KEVCVSS 4.0CRITICAL 9.2
Sources
- CVE-2022-0016 · CVE Program
- CVE-2022-0016 · NVD
- FIRST EPSS
- GHSA-mrwh-mjvv-r5vh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences