CVE-2025-2183 - CVE House
Back to Database
Status published Medium CVE-2025-2183

GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation

Vulnerability Description

An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2183

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Nikola Markovic of Palo Alto Networks
  • Maxime Escorbiac of Michelin CERT

References

More from Palo Alto Networks

View All →
CVE-2025-4619
PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets
Medium 6.6
CVE-2025-4618
Prisma Browser: Sensitive Information Disclosure Vulnerability in Prisma Browser
Medium 4.4
CVE-2025-4617
Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser
Low 1.1
CVE-2025-4616
Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser
Low 1.1
CVE-2025-4615
PAN-OS: Improper Neutralization of Input in the Management Web Interface
Medium 5.5

Affected Vendor

Palo Alto Networks

View all reports →

Affected Software

GlobalProtect App, Global Protect UWP App
Vulnerable Versions:
6.3.0, 6.2.0, 6.1.0, 6.0.0, All

Timeline

Official Publish: August 13th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact