Local Privilege Escalation in OPSWAT MetaDefender SDK Impacting Palo Alto Networks GlobalProtect on Windows
A local privilege escalation vulnerability (CVE-2026-0324) exists in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect app on Windows. This flaw allows any locally authenticated non-administrative user to escalate privileges to NT AUTHORITY\SYSTEM without requiring special configuration. The issue is rated medium severity with a CVSS 5.9 and CVSS-B 8.5 score, reflecting a moderate urgency for patching. Palo Alto Networks has not observed any exploitation in the wild. The vulnerability stems from incorrect privilege assignment (CWE-266) and aligns with CAPEC-233 (Privilege Escalation). It is fixed in MetaDefender Endpoint Security SDK version 4.3.4822 and later; GlobalProtect users should update to versions including this SDK fix. No known mitigations or workarounds exist currently.
Entenda a falha
A vulnerabilidade
CVE-2026-0324 is an incorrect privilege management flaw (CWE-266) in the OPSWAT MetaDefender Endpoint Security SDK that the Palo Alto Networks GlobalProtect app uses on Windows. An attacker needs a local, authenticated, non-administrative Windows account. No special configuration, user interaction or network access is required. The result is escalation to NT AUTHORITY\SYSTEM. SDK versions 4.3.0 up to but excluding 4.3.4822 are affected, and 4.3.4822 and later are fixed. Palo Alto rates it Medium (CVSS-BT 5.9, CVSS-B 8.5) and is not aware of exploitation.
Como funciona
The sources do not describe the internal mechanism in detail. From what they say, the SDK is bundled with the GlobalProtect app on Windows and runs with higher privileges than a normal user. A local standard user can reach functionality of this component, and the component handles privileges incorrectly. As a result, the user's actions end up executing with SYSTEM rights instead of being limited to the user's own.
Por que é vulnerável
The root cause is classified as incorrect privilege assignment (CWE-266), mapped to CAPEC-233 (Privilege Escalation): the SDK gives or retains more privilege than a non-administrative user should be able to obtain. The articles do not say why it went unnoticed. The fix is in SDK 4.3.4822, and GlobalProtect app builds that include that SDK carry it. No workaround or mitigation exists.
Como foi descoberta
The articles do not say who found the flaw or how. The only disclosure is the Palo Alto Networks security advisory published on 2026-11-11, which states the company is not aware of any malicious exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 14:17.
Linha do tempo
-
Local Privilege Escalation in OPSWAT MetaDefender SDK Impacting Palo Alto Networks GlobalProtect on Windows
ler a análise desta fonte ocultar
A local privilege escalation vulnerability (CVE-2026-0324) exists in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect app on Windows. This flaw allows any locally authenticated non-administrative user to escalate privileges to NT AUTHORITY\SYSTEM without requiring special configuration. The issue is rated medium severity with a CVSS 5.9 and CVSS-B 8.5 score, reflecting a moderate urgency for patching. Palo Alto Networks has not observed any exploitation in the wild. The vulnerability stems from incorrect privilege assignment (CWE-266) and aligns with CAPEC-233 (Privilege Escalation). It is fixed in MetaDefender Endpoint Security SDK version 4.3.4822 and later; GlobalProtect users should update to versions including this SDK fix. No known mitigations or workarounds exist currently.