CVE-2025-0140 MEDIUM

CVE-2025-0140: GlobalProtect App: Non Admin User Can Disable the GlobalProtect App

Vendor Palo Alto Networks
Product GlobalProtect App
Weakness CWE-266
Published July 9, 2025
Last update July 30, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

What the vulnerability does

01Description

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

Key dates

02Disclosure timeline

July 9, 2025 CVE published
July 30, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-49413 Flaw in Linuxulator execution of setugid binaries CVE-2023-29066 Incorrect User Management CVE-2012-4549 Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization CVE-2021-1416 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerabilities CVE-2022-20759 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability