CVE-2025-0135CWE-266

GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App

Medium · published May 14, 2025

CVSS v4.0
5.2
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app.

The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

The record
Technical detail
CVSS v4.0
5.2 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber
EPSS
0.00137 · 2.8th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-05-14T18:08Z
EPSS history
Timeline
  • 14 MAY 18:08Z
    GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App
    cvelistv5