What’s Vulnerable › Vulnerabilities

CVE-2022-0016: GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-10 · updated 2026-06-17
• Weakness: CWE-703

Description

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.

Affected products

• Palo Alto Networks GlobalProtect App: from 5.2 before 5.2.9 — fixed in 5.2.9
• Palo Alto Networks GlobalProtect App: from 5.2 before 5.2.9 — fixed in 5.2.9

How to fix

Upgrade to a fixed version: Palo Alto Networks GlobalProtect App 5.2.9; Palo Alto Networks GlobalProtect App 5.2.9. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2022-0016
• https://security.paloaltonetworks.com/CVE-2022-0016

Get alerted when CVE-2022-0016 or the next vulnerability affects your stack