{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/globalprotect-app-6.3-6.3.0---6.3.3-h2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opswat:metadefender_endpoint_security_sdk:*:*:*:*:*:Windows:*:*"],"_cs_cves":[{"id":"CVE-2026-0324"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MetaDefender Endpoint Security SDK (4.3.0 - 4.3.4821)","GlobalProtect App 6.3 (6.3.0 - 6.3.3-h2)","GlobalProtect App 6.2 (6.2.0 - 6.2.8-h3)"],"_cs_severities":["medium"],"_cs_tags":["cve-2026-0324","privilege-escalation","windows"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks","OPSWAT"],"content_html":"\u003cp\u003eA local privilege escalation vulnerability (CVE-2026-0324) exists in the OPSWAT MetaDefender Endpoint Security SDK integrated into the Palo Alto Networks GlobalProtect app for Windows. A locally authenticated non-administrative user can exploit this vulnerability to achieve NT AUTHORITY\\SYSTEM privileges. The vulnerability does not require special configuration or user interaction for exploitation. Palo Alto Networks reports no known malicious exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker with low-privileged local access to elevate their permissions to NT AUTHORITY\\SYSTEM, potentially granting them full control over the compromised Windows endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade GlobalProtect App 6.3 on Windows to version 6.3.3-h3 (6.3.3-711) or later.\u003c/li\u003e\n\u003cli\u003eUpgrade GlobalProtect App 6.2 on Windows to version 6.2.8-h4 (6.2.8-317) or later.\u003c/li\u003e\n\u003cli\u003eThese versions include the fixed MetaDefender Endpoint Security SDK 4.3.4822.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:54:12Z","date_published":"2026-11-11T21:54:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-0324-globalprotect-privesc/","summary":"An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated, non-administrative user to escalate their privileges to NT AUTHORITY\\SYSTEM.","title":"Palo Alto Networks GlobalProtect: Privilege Escalation in MetaDefender Endpoint Security SDK (CVE-2026-0324)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-0324-globalprotect-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - GlobalProtect App 6.3 (6.3.0 - 6.3.3-H2)","version":"https://jsonfeed.org/version/1.1"}