Palo Alto GlobalProtect Certificate Verification Flaw Leading to Privilege Escalation (CVE-2025-2183)

Key Information Summary Vulnerability Overview CVE ID: CVE-2025-2183 Vulnerability Type: Improper certificate validation leading to privilege escalation Severity: Medium (4.5) Urgency: Medium Affected Scope Affected Versions: - GlobalProtect App 6.3: = 6.3.3-h2 (6.3.3-c676) on Windows, >= 6.3.3 on Linux (ETA: 9/2) - GlobalProtect App 6.2: >= 6.2.8-h3 (6.2.8-c253) on Windows, None on Linux - GlobalProtect App 6.1: None on Windows, None on Linux - GlobalProtect App 6.0: None on Windows, None on Linux Configuration Requirements GlobalProtect installations are affected if any of the following conditions are true: 1. The portal pushes certificates to the client, which are used to validate portal or gateway certificates. These certificates are stored in the file. 2. The GlobalProtect application is deployed with the option set to . Remediation Recommended Remediation: - Upgrade to the specified latest version. - For existing GlobalProtect installations on Windows/Linux: 1. Revoke portal/gateway certificates using the operating system certificate store. 2. Remove any certificates associated with the portal’s “trusted root CA”. 3. Enable portal setting: “Enable Secure Certificate Check”. Timeline Initial Release: 2025-08-14 Acknowledgments Palo Alto Networks thanks Nicolas Menezo and Maxime Escorcia for discovering and reporting this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Palo Alto GlobalProtect Certificate Verification Flaw Leading to Privilege Escalation (CVE-2025-2183)