CVE-2025-2183 GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation
Description
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Global Protect UWP App | None | All |
| GlobalProtect App | None on Android None on iOS None on macOS | All on Android All on iOS All on macOS |
| GlobalProtect App 6.3 | < 6.3.3-h2 (6.3.3-c676) on Windows < 6.3.3 on Linux | >= 6.3.3-h2 (6.3.3-c676) on Windows* >= 6.3.3 on Linux (ETA: 9/1)* |
| GlobalProtect App 6.2 | < 6.2.8-h3 (6.2.8-c263) on Windows All on Linux | >= 6.2.8-h3 (6.2.8-c263) on Windows* None on Linux |
| GlobalProtect App 6.1 | All on Windows All on Linux | None on Windows None on Linux |
| GlobalProtect App 6.0 | All on Windows All on Linux | None on Windows* None on Linux |
* In addition to the software updates listed above, additional steps are required to protect against this vulnerability. See the Solution section for full details.
Required Configuration for Exposure
GlobalProtect installations are impacted if either of the following conditions is true:
1. The portal pushes certificates to the client, which are then used to validate the Portal or Gateway's certificate. These certificates are stored in the tca.cer file. If the certificates listed in "Trusted Root CA" include the entire certificate chain for the Portal or Gateway certificate, the configuration will be vulnerable. 
2. GlobalProtect app is deployed with the “FULLCHAINCERTVERIFY” option set to yes. To learn more about this configuration, see the Solution section of this advisory.
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 4.5 / CVSS-B: 7.4 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-295 Improper Certificate Validation
CAPEC-233 Privilege Escalation
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| GlobalProtect App 6.3 on Windows |
6.3.0 through 6.3.2 | Upgrade to 6.3.2-h9 or 6.3.3-h2 or later*. |
| GlobalProtect App 6.2 on Windows |
6.2.0 through 6.2.8 | Upgrade to 6.2.8-h3 or later*. |
| GlobalProtect App 6.1 on Windows | Upgrade to 6.2.8-h3 or 6.3.3-h2 or later*. | |
| GlobalProtect App 6.0 on Windows |
Upgrade to 6.2.8-h3 or 6.3.3-h2 or later*. | |
| GlobalProtect App 6.3 on Linux |
6.3.0 through 6.3.2 | Upgrade to 6.3.3 or later*. |
| GlobalProtect App 6.2 on Linux | Upgrade to 6.3.3 or later*. | |
| GlobalProtect App 6.1 on Linux | Upgrade to 6.3.3 or later*. | |
| GlobalProtect App 6.0 on Linux | Upgrade to 6.3.3 or later*. | |
| GlobalProtect App on Android, iOS, macOS | No action needed. | |
| GlobalProtect UWP App | No action needed. |
* In addition to the software updates listed above, additional steps are required to protect against this vulnerability as described below:
Solution for new and existing GlobalProtect app installation on Windows / Linux
- Ensure the portal/gateway certificate can be validated using the operating system's certificate store (e.g., Local Machine Certificate Store or Current User Certificate Store in Windows; for Linux, refer to this documentation).
- Remove any certificates associated with portal/gateway validation from the "Trusted Root CA" list on the Portal.
- Enable portal setting: “Enable Strict Certificate Check” (set FULLCHAINCERTVERIFY to yes).
Workarounds and Mitigations
No known workarounds exist for this issue.
Acknowledgments
CPEs
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*
CPE Applicability
- cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:* is vulnerable from (including)6.3.3 and up to (excluding)6.3.3-h2_(6.3.3-c676)
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:* is vulnerable from (including)6.2.8 and up to (excluding)6.2.8-h3_(6.2.8-c263)
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:* is vulnerable from (including)6.1.0
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:* is vulnerable from (including)6.0.0
- or
- cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:* is vulnerable from (including)6.3.0 and up to (excluding)6.3.3
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:* is vulnerable from (including)6.2.0
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:* is vulnerable from (including)6.1.0
- ORcpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:* is vulnerable from (including)6.0.0