vulnerability
Palo Alto Networks GlobalProtect App: CVE-2025-2183: Improper Certificate Validation Leads to Privilege Escalation
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:L/AC:H/Au:N/C:C/I:C/A:N) | Aug 13, 2025 | Aug 14, 2025 | Jan 19, 2026 |
Severity
6
CVSS
(AV:L/AC:H/Au:N/C:C/I:C/A:N)
Published
Aug 13, 2025
Added
Aug 14, 2025
Modified
Jan 19, 2026
Description
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Solution
palo-alto-networks-globalprotect-app-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.