Privilege escalation in Palo Alto Networks Globalprotect App
CVE-2025-2179
An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (2.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Palo Alto Networks Globalprotect App — versions 6.2.0, 6.1.0, 6.0.0
- Palo Alto Networks Globalprotect Uwp App — versions All
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.paloaltonetworks.com/CVE-2025-2179 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-2179?
- CVE-2025-2179 is a vulnerability in Palo Alto Networks Globalprotect App, classified under Incorrect Privilege Assignment. Published 2025-07-29.
- Is CVE-2025-2179 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.