OPSWAT - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/opswat/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 21:54:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPalo Alto Networks GlobalProtect: Privilege Escalation in MetaDefender Endpoint Security SDK (CVE-2026-0324)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-0324-globalprotect-privesc/Wed, 11 Nov 2026 21:54:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-0324-globalprotect-privesc/An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated, non-administrative user to escalate their privileges to NT AUTHORITY\SYSTEM.A local privilege escalation vulnerability (CVE-2026-0324) exists in the OPSWAT MetaDefender Endpoint Security SDK integrated into the Palo Alto Networks GlobalProtect app for Windows. A locally authenticated non-administrative user can exploit this vulnerability to achieve NT AUTHORITY\SYSTEM privileges. The vulnerability does not require special configuration or user interaction for exploitation. Palo Alto Networks reports no known malicious exploitation in the wild.

Impact

Successful exploitation allows an attacker with low-privileged local access to elevate their permissions to NT AUTHORITY\SYSTEM, potentially granting them full control over the compromised Windows endpoint.

Recommendation

  • Upgrade GlobalProtect App 6.3 on Windows to version 6.3.3-h3 (6.3.3-711) or later.
  • Upgrade GlobalProtect App 6.2 on Windows to version 6.2.8-h4 (6.2.8-317) or later.
  • These versions include the fixed MetaDefender Endpoint Security SDK 4.3.4822.
]]>mediumadvisorycve-2026-0324privilege-escalationwindows