CVE-2025-0135

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://security.paloaltonetworks.com/CVE-2025-0135	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*

History

27 Jun 2025, 16:50

Type	Values Removed	Values Added
First Time		Paloaltonetworks globalprotect Paloaltonetworks
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.3
CPE		cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
References	~~() https://security.paloaltonetworks.com/CVE-2025-0135 -~~	() https://security.paloaltonetworks.com/CVE-2025-0135 - Vendor Advisory

16 May 2025, 14:43

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de asignación incorrecta de privilegios en la aplicación GlobalProtect™ de Palo Alto Networks en dispositivos macOS permite que un usuario no administrativo autenticado localmente desactive la aplicación. La aplicación GlobalProtect en Windows, Linux, iOS, Android, Chrome OS y la aplicación GlobalProtect UWP no se ven afectadas.

14 May 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-14 19:15

Updated : 2025-06-27 16:50

NVD link : CVE-2025-0135

Mitre link : CVE-2025-0135

CVE.ORG link : CVE-2025-0135

JSON object : View

Products Affected

paloaltonetworks

globalprotect

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2025-0135", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.2, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-14T19:15:51.817", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2025-0135", "tags": ["Vendor Advisory"], "source": "psirt@paloaltonetworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect\u2122 App on macOS devices enables a locally authenticated non administrative user to disable the app.\n\nThe GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected."}, {"lang": "es", "value": "Una vulnerabilidad de asignaci\u00f3n incorrecta de privilegios en la aplicaci\u00f3n GlobalProtect\u2122 de Palo Alto Networks en dispositivos macOS permite que un usuario no administrativo autenticado localmente desactive la aplicaci\u00f3n. La aplicaci\u00f3n GlobalProtect en Windows, Linux, iOS, Android, Chrome OS y la aplicaci\u00f3n GlobalProtect UWP no se ven afectadas."}], "lastModified": "2025-06-27T16:50:37.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "B2DE8243-7786-4D7C-A0CB-A3D3E44C9B26", "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "EFAA1A23-5A3C-48FA-8672-D8329D67A14C", "versionEndExcluding": "6.3.3", "versionStartIncluding": "6.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@paloaltonetworks.com"}