Palo Alto Networks GlobalProtect: Privilege Escalation in MetaDefender Endpoint Security SDK (CVE-2026-0324)
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated, non-administrative user to escalate their privileges to NT AUTHORITY\SYSTEM.
CVE search metadata
CVE search record: CVE-2026-0324. KEV: no. Product: MetaDefender Endpoint Security SDK (4.3.0 - 4.3.4821), GlobalProtect App 6.3 (6.3.0 - 6.3.3-h2), GlobalProtect App 6.2 (6.2.0 - 6.2.8-h3). Brief: Palo Alto Networks GlobalProtect: Privilege Escalation in MetaDefender Endpoint Security SDK (CVE-2026-0324). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-0324-globalprotect-privesc/
Triage facts
Revision 1- Applicability
- MetaDefender Endpoint Security SDK (4.3.0 - 4.3.4821), GlobalProtect App 6.3 (6.3.0 - 6.3.3-h2) +1
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 21:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
A local privilege escalation vulnerability (CVE-2026-0324) exists in the OPSWAT MetaDefender Endpoint Security SDK integrated into the Palo Alto Networks GlobalProtect app for Windows. A locally authenticated non-administrative user can exploit this vulnerability to achieve NT AUTHORITY\SYSTEM privileges. The vulnerability does not require special configuration or user interaction for exploitation. Palo Alto Networks reports no known malicious exploitation in the wild.
Impact
Successful exploitation allows an attacker with low-privileged local access to elevate their permissions to NT AUTHORITY\SYSTEM, potentially granting them full control over the compromised Windows endpoint.
Recommendation
- Upgrade GlobalProtect App 6.3 on Windows to version 6.3.3-h3 (6.3.3-711) or later.
- Upgrade GlobalProtect App 6.2 on Windows to version 6.2.8-h4 (6.2.8-317) or later.
- These versions include the fixed MetaDefender Endpoint Security SDK 4.3.4822.
Immediate actions
Upgrade affected GlobalProtect App installations to the provided fixed versions (6.3.3-h3 or 6.2.8-h4).
Threat Hunt
Monitor for unexpected child processes spawned by the GlobalProtect service or MetaDefender SDK components, specifically those running as SYSTEM that deviate from expected patterns.
Data: Sysmon Event ID 1, EDR process lineage logs
Mitigations
Upgrade to GlobalProtect App 6.3.3-h3 or 6.2.8-h4 or later.
CVE-2026-0324