CVE-2025-4232
GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
- Published
- Updated
- Reserved
- Assigned by
- palo_alto
Description
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| palo_altoCNA (assigner) | 4.0 | High8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber |
| NVDNVD · Analyzed | 4.0 | High8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber |
- EPSS (exploitation in 30 days)
- 0.45% · top 60% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.
Weakness
Affected products
Palo Alto Networks · GlobalProtect App
- affected 6.3 – < 6.3.3
- affected 6.2.0 – < 6.2.8-h2
- affected 6.1.0
- affected 6.0.0
Palo Alto Networks · GlobalProtect App
- unaffected All
What to do
Solution: Version Minor Version Suggested Solution GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.2 Upgrade to 6.3.3 or later. GlobalProtect App 6.2 on macOS6.2.0 through 6.2.8-h2Upgrade to 6.2.8-h2 [ETA June 2025] or 6.3.3 or later.GlobalProtect App 6.1 on macOSUpgrade to 6.2.8-h2 [ETA June 2025] or 6.3.3 or later.GlobalProtect App 6.0 on macOSUpgrade to 6.2.8-h2 [ETA June 2025] or 6.3.3 or later.GlobalProtect App on Windows No action needed.GlobalProtect App on Linux No action needed.GlobalProtect App on Android No action needed.GlobalProtect App on iOS No action needed.GlobalProtect App on Chrome OS No action needed.
Workaround: No workaround or mitigation is available.
Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-4232)Record last updated .