vulnerability
Palo Alto Networks GlobalProtect App: CVE-2020-1988: Local privilege escalation due to an unquoted search path vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:L/Au:N/C:C/I:C/A:C) | Apr 8, 2020 | May 21, 2025 | Mar 25, 2026 |
Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
Apr 8, 2020
Added
May 21, 2025
Modified
Mar 25, 2026
Description
An unquoted search path vulnerability in the Windows release of GlobalProtect App allows an authenticated local user with file creation privileges on the root of the OS disk (C:\) or to Program Files directory to gain system privileges.
This issue affects Palo Alto Networks GlobalProtect App 5.0 versions before 5.0.5; 4.1 versions before 4.1.13 on Windows;
This issue affects Palo Alto Networks GlobalProtect App 5.0 versions before 5.0.5; 4.1 versions before 4.1.13 on Windows;
Solution
palo-alto-networks-globalprotect-app-upgrade-latest
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.