CVE-2025-0120: GlobalProtect Privilege Escalation Flaw

CVE-2025-0120 Overview

CVE-2025-0120 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows. A locally authenticated non-administrative Windows user can escalate privileges to NT AUTHORITY\SYSTEM by exploiting a flaw in the app's privilege management mechanism. Successful exploitation requires winning a race condition, which increases attack complexity. The weakness is categorized under [CWE-250] (Execution with Unnecessary Privileges).

Critical Impact
An attacker with local, low-privileged access to a Windows endpoint running GlobalProtect can obtain full SYSTEM-level control, enabling credential theft, endpoint tampering, and lateral movement.

Affected Products

Palo Alto Networks GlobalProtect app on Windows
Refer to the Palo Alto Networks Advisory for exact affected versions
Non-Windows GlobalProtect distributions are not listed as affected

Discovery Timeline

2025-04-11 - CVE-2025-0120 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0120

Vulnerability Analysis

The vulnerability resides in a privilege management mechanism within the GlobalProtect Windows client. GlobalProtect runs privileged service components that interact with user-context processes to perform configuration and connection tasks. A local, low-privileged user can influence one of these privileged operations to execute actions in the SYSTEM security context.

Exploitation depends on a race condition, meaning the attacker must interpose between a check performed by the privileged component and its subsequent use of a resource. This TOCTOU (Time-of-Check Time-of-Use) pattern is a common consequence of [CWE-250], where a process executes with more privilege than required and does not adequately validate inputs or paths supplied by lower-privileged callers.

Root Cause

The root cause is execution with unnecessary privileges combined with insufficient synchronization. A privileged GlobalProtect component performs an operation that trusts state controllable by a non-administrative user. When the attacker replaces or modifies that state between validation and use, the privileged code carries out the action on attacker-controlled input, yielding SYSTEM execution.

Attack Vector

The attack vector is local. The adversary must already be authenticated to the Windows host as a standard user. The attacker triggers a privileged GlobalProtect operation and concurrently manipulates the target resource — typically a file path, symbolic link, or object handle — to point at an attacker-controlled artifact at the moment the privileged process consumes it. Because the race window is narrow, reliable exploitation requires repeated attempts and precise timing. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available. See the Palo Alto Networks Advisory for vendor-provided technical details.

Detection Methods for CVE-2025-0120

Indicators of Compromise

Unexpected child processes spawned by the GlobalProtect service (PanGPS.exe) running as NT AUTHORITY\SYSTEM
Creation, deletion, or symlinking of files under GlobalProtect working directories by non-administrative user accounts
Repeated rapid file system operations targeting GlobalProtect paths, indicative of race condition attempts

Detection Strategies

Monitor for privileged process launches whose parent is a GlobalProtect service but whose command line references user-writable paths
Alert on standard users creating NTFS junctions, hard links, or symbolic links inside GlobalProtect program or ProgramData directories
Correlate high-frequency file open/rename events on GlobalProtect resources with subsequent SYSTEM-level process creation

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on all endpoints running GlobalProtect
Forward Sysmon events (Process Create, File Create, CreateRemoteThread) to a centralized analytics platform for behavioral review
Track integrity-level transitions where a Medium integrity process leads to a System integrity child process within a short time window

How to Mitigate CVE-2025-0120

Immediate Actions Required

Identify all Windows endpoints running the GlobalProtect app and inventory installed versions
Apply the fixed GlobalProtect version published in the Palo Alto Networks Advisory as soon as change control permits
Restrict local logon on high-value systems to trusted administrators until patching is complete
Review endpoint logs for anomalous SYSTEM process creation associated with GlobalProtect

Patch Information

Palo Alto Networks has published fixed versions of the GlobalProtect Windows app. Consult the vendor advisory at security.paloaltonetworks.com/CVE-2025-0120 for the exact fixed release trains and upgrade guidance. Deploy the update through your standard endpoint management tooling and confirm the installed version post-deployment.

Workarounds

No official pre-patch workaround has been published by the vendor; upgrading is the recommended remediation
Reduce local user counts on affected hosts and enforce the principle of least privilege to limit who can attempt local exploitation
Apply application allowlisting to block unauthorized binaries from executing under user contexts that could initiate the race
Monitor GlobalProtect installation directories for unauthorized modification and revoke write permissions where feasible

bash

# Verify installed GlobalProtect version on a Windows endpoint (PowerShell)
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'GlobalProtect*' } |
  Select-Object Name, Version, InstallDate