CVE-2022-0016
GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
- Published
- Updated
- Reserved
- Assigned by
- palo_alto
Description
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| palo_altoCNA (assigner) | 3.1 | High7.4 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
Affected products
Palo Alto Networks · GlobalProtect App
- affected 5.2 – < 5.2.9
Palo Alto Networks · GlobalProtect App
- unaffected 5.3.*
- unaffected 5.1.* – < 5.1*
What to do
Solution: This issue is fixed in GlobalProtect app 5.2.9 on Windows and MacOS, and all later GlobalProtect app versions.
Workaround: There are no known workarounds for this issue.
Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.
References (1)
- https://security.paloaltonetworks.com/CVE-2022-0016 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-0016)Record last updated .