CVE-2026-0324
GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Fixes and workarounds
Fix
This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4822 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK): VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h2 Upgrade to 6.3.3-h3 (6.3.3-711) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h3 Upgrade to 6.2.8-h4 (6.2.8-317) or later. GlobalProtect App on macOS No action needed. GlobalProtect App on Linux No action needed. GlobalProtect App on iOS No action needed. GlobalProtect App on Android No action needed. GlobalProtect UWP App No action needed.
Source: CNA: palo_altoWorkaround
No known workarounds or mitigations exist for this issue.
Source: CNA: palo_altoAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| MetaDefender Endpoint Security SDK OPSWAT Platforms: Windows |
≥ 4.3.0; < 4.3.4822 (affected, custom); unaffected at 4.3.4822
Other versions: unaffected |
CNA: palo_alto |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 5.9 medium |
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber | CNA: palo_alto |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://security.paloaltonetworks.com/CVE-2026-0324CNA: palo_alto · third-party-advisory
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.