This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Palo Alto fixes 3 vulnerabilities

Palo Alto fixes 3 vulnerabilities in 2 products [1][2][3]. Products and their fixed versions: Autonomous Digital Experience Manager (macOS) - 5.6.7 [1] GlobalProtect™ App (macOS, Windows) - 6.3.3-h1 (6.3.3-c650), 6.2.8-h2 (6.2.8-c243) [2][3] GlobalProtect™ App (Linux) - 6.2.8 [2] [3]

Palo Alto Networks Autonomous Digital Experience Manager - privilege escalation (CVE-2025-0139)
CVSS 2.4 (Low)

An authenticated local attacker can escalate their privileges to root in Autonomous Digital Experience Manager (macOS) [1].

The vulnerability is present in product:

  • macOS: Palo Alto Networks Autonomous Digital Experience Manager; >=5.6, <5.6.7;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

Palo Alto Networks GlobalProtect™ App - unauthorized management (CVE-2025-0140)
CVSS 4.3 (Medium)

An authenticated local attacker can disable the GlobalProtect™ App (macOS, Linux) without authorization [2].

The vulnerability is present in products:

  • macOS: Palo Alto Networks GlobalProtect™ App; >=6.0, <6.2.8-h2 (6.2.8-c243); >=6.3, <6.3.3-h1 (6.3.3-c650);
  • Linux: Palo Alto Networks GlobalProtect™ App; >=6.0, <6.2.8;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

Palo Alto Networks GlobalProtect™ App - privilege escalation (CVE-2025-0141)
CVSS 5.7 (Medium)

An authenticated local attacker can escalate their privileges in GlobalProtect™ App (macOS, Linux, Windows) to root or NT AUTHORITY\SYSTEM, respectively [3].

The vulnerability is present in products:

  • MacOS: Palo Alto Networks GlobalProtect™ App; >=6.0, <6.2.8-h2 (6.2.8-c243); >=6.3, <6.3.3-h1 (6.3.3-c650);
  • Windows: Palo Alto Networks GlobalProtect™ App; >=6.0, <6.2.8-h2 (6.2.8-c243); >=6.3, <6.3.3-h1 (6.3.3-c650);
  • Linux: Palo Alto Networks GlobalProtect™ App; >=6.0, <6.2.8;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

By CESNET, z.s.p.o. Martin Krajči on 10. 7. 2025.

CESNET, z.s.p.o. Logo