CVE-2024-2432: GlobalProtect Privilege Escalation Flaw

CVE-2024-2432 Overview

CVE-2024-2432 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows. A local user can execute programs with elevated privileges by winning a race condition in the affected component. The flaw maps to [CWE-269] Improper Privilege Management and requires local access plus successful timing exploitation. Palo Alto Networks published the advisory on March 13, 2024, and the National Vulnerability Database (NVD) last updated the record on September 26, 2025. Exploitation is rated high complexity due to the race condition, and no public proof-of-concept or in-the-wild exploitation has been confirmed.

Critical Impact

A local attacker on a Windows endpoint running a vulnerable GlobalProtect agent can escalate to SYSTEM-level privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

• Palo Alto Networks GlobalProtect app for Windows (multiple versions prior to the vendor-supplied fix)
• Palo Alto Networks GlobalProtect 6.2.0 for Windows
• GlobalProtect agent deployments on Windows endpoints managed by Palo Alto Networks firewalls

Discovery Timeline

• 2024-03-13 - CVE-2024-2432 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2024-2432

Vulnerability Analysis

The vulnerability resides in the GlobalProtect Windows client, a privileged endpoint agent that performs operations under the SYSTEM account. A low-privileged local user can interfere with a sequence of operations performed by the privileged service. By winning a race condition between a check and a subsequent action, the attacker causes the service to operate on attacker-controlled resources. The result is execution of arbitrary programs at higher privilege than the calling user.

This class of flaw is a Time-of-Check to Time-of-Use (TOCTOU) condition. The privileged process validates a resource state, but the attacker modifies that resource before the service consumes it. Successful exploitation grants full control of the Windows host, including the ability to install software, modify drivers, and access protected credentials.

Root Cause

The root cause is improper privilege management ([CWE-269]) combined with a race condition in privileged file or object handling. The GlobalProtect service does not atomically validate and operate on the target resource. Attackers exploit this gap to substitute trusted paths or objects with attacker-controlled equivalents.

Attack Vector

Exploitation requires authenticated local access to the Windows host. The attacker must already have low-privileged code execution and must reliably win a timing window against the privileged service. No user interaction is required. Network-based exploitation is not possible.

No verified public exploit code is available for CVE-2024-2432. Refer to the Palo Alto Networks Advisory for vendor technical details.

Detection Methods for CVE-2024-2432

Indicators of Compromise

• Unexpected child processes spawned by PanGPS.exe or other GlobalProtect service binaries running as SYSTEM
• New or modified files in directories used by the GlobalProtect service immediately followed by privileged operations on those paths
• Symbolic link, hard link, or junction creation in user-writable directories that the GlobalProtect service subsequently accesses

Detection Strategies

• Monitor process lineage for SYSTEM-level processes whose parent is a GlobalProtect service binary and whose command line was not initiated by an administrator
• Alert on file system race patterns: rapid create, delete, and replace operations on paths touched by privileged Palo Alto Networks processes
• Track installation of unauthorized GlobalProtect versions and verify versions against the vendor's fixed builds

Monitoring Recommendations

• Enable Windows Sysmon event IDs 1, 11, and 17 to capture process creation, file creation, and pipe events around GlobalProtect binaries
• Forward endpoint telemetry to a centralized SIEM or data lake and correlate privileged GlobalProtect activity with user-context process trees
• Audit local user accounts on systems running GlobalProtect and restrict interactive logon where possible

How to Mitigate CVE-2024-2432

Immediate Actions Required

• Inventory all Windows endpoints running the GlobalProtect app and identify versions in scope of the vendor advisory
• Upgrade GlobalProtect to a fixed release as specified in the Palo Alto Networks Advisory
• Restrict local interactive and Remote Desktop access on endpoints to trusted administrators while patching is in progress

Patch Information

Palo Alto Networks has released fixed versions of the GlobalProtect app for Windows. Consult the Palo Alto Networks Advisory for the exact fixed version matrix and upgrade guidance for 6.2.x and earlier supported branches. Apply vendor patches through your standard endpoint management or software distribution tooling.

Workarounds

• Limit local logon rights on Windows hosts running vulnerable GlobalProtect versions to reduce the attacker population
• Enforce application control policies that block unsigned or unauthorized binaries from executing on endpoints
• Increase monitoring around GlobalProtect service activity until patched versions are deployed across the fleet

# Verify installed GlobalProtect version on Windows
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*GlobalProtect*" } | Select-Object Name, Version