CVE-2025-0117CWE-807

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

High · published March 12, 2025

CVSS v4.0
7.1
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber
EPSS
0.00164 · 5.3th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2025-03-12T18:35Z
EPSS history
Timeline
  • 12 MAR 18:35Z
    GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
    cvelistv5