CVE-2025-0140
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-07-30
Assigner: Palo Alto Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palo_alto_networks | globalprotect | 6.1 |
| palo_alto_networks | globalprotect | 6.3 |
| palo_alto_networks | globalprotect | 6.0 |
| palo_alto_networks | globalprotect | 6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect privilege assignment in the Palo Alto Networks GlobalProtect App on macOS and Linux devices. It allows a locally authenticated non-administrative user to disable the GlobalProtect app even if the app's configuration normally would not permit this action.
How can this vulnerability impact me? :
The vulnerability could allow a non-administrative user on macOS or Linux to disable the GlobalProtect app, potentially reducing the security posture of the device by disabling VPN protection or other security features provided by the app.