CVE-2026-0324 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows

Palo Alto Networks Security Advisories / CVE-2026-0324

CVE-2026-0324 GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows

Urgency MODERATE

Severity 5.9 · MEDIUM

Exploit Maturity UNREPORTED

Response Effort N/A

Recovery USER

Value Density DIFFUSE

Attack Vector LOCAL

Attack Complexity LOW

Attack Requirements NONE

Automatable NO

User Interaction NONE

Product Confidentiality HIGH

Product Integrity HIGH

Product Availability HIGH

Privileges Required LOW

Subsequent Confidentiality NONE

Subsequent Integrity NONE

Subsequent Availability NONE

CVE JSON CSAF

Published 2026-11-11

Updated 2026-11-11

Discovered externally

Description

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

Product Status

Versions	Affected	Unaffected
MetaDefender Endpoint Security SDK 4.3.0	< 4.3.4822 on Windows	>= 4.3.4822 on Windows

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: MEDIUM, Suggested Urgency: MODERATE

CVSS-BT: 5.9 / CVSS-B: 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-266: Incorrect Privilege Assignment

CAPEC-233 Privilege Escalation

Solution

This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4822 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK):

Version	Minor Version	Suggested Solution
GlobalProtect App 6.3 on Windows	6.3.0 through 6.3.3-h2	Upgrade to 6.3.3-h3 (6.3.3-711) or later.
GlobalProtect App 6.2 on Windows	6.2.0 through 6.2.8-h3	Upgrade to 6.2.8-h4 (6.2.8-317) or later.
GlobalProtect App on macOS		No action needed.
GlobalProtect App on Linux		No action needed.
GlobalProtect App on iOS		No action needed.
GlobalProtect App on Android		No action needed.
GlobalProtect UWP App		No action needed.

Workarounds and Mitigations

No known workarounds or mitigations exist for this issue.

Acknowledgments

Palo Alto Networks thanks Sandro Poppi for discovering and reporting this issue.

CPE Applicability

cpe:2.3:a:opswat:metadefender_endpoint_security_sdk:*:*:*:*:*:Windows:*:* is vulnerable from (including)4.3.0 and up to (excluding)4.3.4822

Timeline

2026-11-11 Initial Publication