The vulnerability is categorized as Medium severity and is documented with a CVSS-BT score of 5.9. Exploitation requires local access, and Palo Alto Networks has confirmed that there is currently no evidence of malicious exploitation in the wild. Full remediation requires a coordinated update of both the client-side GlobalProtect application and the server-side infrastructure (PAN-OS or Prisma Access). iOS, Android, and ChromeOS versions of the app are not affected.

Impact

Successful exploitation allows a low-privileged local user to achieve full administrative control over the affected endpoint. This can lead to total system compromise, unauthorized data access, persistence installation, and further lateral movement within the network. The scope of impact is broad due to the ubiquity of GlobalProtect clients in enterprise environments.

Recommendation

Prioritize the deployment of updated GlobalProtect client versions across all Windows, macOS, and Linux endpoints. Concurrently, schedule and execute upgrades for all affected PAN-OS and Prisma Access infrastructure components to ensure compatibility and full mitigation.

• Upgrade GlobalProtect App on Linux, macOS, and Windows to the versions specified in the Palo Alto Networks advisory (e.g., 6.3.3-h15 or later).
• Update all PAN-OS and Prisma Access environments to the patched versions listed in the Solution section of the source advisory to ensure the infrastructure components are no longer vulnerable.
• Audit endpoint security logs for unauthorized process execution or unexpected binary loading from untrusted directories.