CVE-2025-0140CWE-266

GlobalProtect App: Non Admin User Can Disable the GlobalProtect App

Medium · published July 9, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.

The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-07-09T22:58Z
EPSS history
Timeline
  • 09 JUL 22:58Z
    GlobalProtect App: Non Admin User Can Disable the GlobalProtect App
    cvelistv5