CVE-2022-0016

Description

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app when the feature is configured to use SAML authentication that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2022-0016 on 2026-07-27. Shown when MITRE's text differs from the cvelistV5 mirror.

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.

Overview

State

—

Assigner (CNA)

—

CVSS severity

—

CVSS score

—

CVSS vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Effective score

7.4 / 10 HIGH source: NVD

CWE(s)

—

Reserved

—

Published

2022-02-09 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/palo-alto-networks-globalprotect-app-cve-2022-0016/

Linked Threat

CVE-2022-0016 — GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon With SAML Authentication

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2022-02-10 18:15:08 UTC

NVD last modified

2026-06-17 04:19:53 UTC

NVD CVSS v3.1

7.4 / 10 HIGH source: psirt@paloaltonetworks.com

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

1.4 / 10

Impact subscore

5.9 / 10

EPSS score

0.0021 (probability of exploitation in next 30 days)

EPSS percentile

11.23% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-703, CWE-755 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-15237

Assigner

palo_alto

Published

Feb 10, 2022, 6:10:16 PM

Updated

Sep 17, 2024, 2:00:45 AM

EUVD base score (CVSS 3.1)

7.4 / 10
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.2100

Vendors

Palo Alto Networks

Products

GlobalProtect App (5.2 <5.2.9)

Aliases

GHSA-mrwh-mjvv-r5vh

ENISA description: An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances. This issue impacts GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS. This issue does not affect the GlobalProtect app on other platforms.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://security.paloaltonetworks.com/CVE-2022-0016 x_refsource_MISC

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• http://cwe.mitre.org/data/definitions/755.html rapid7:cwe.mitre.org
• https://attackerkb.com/topics/CVE-2022-0016 rapid7:attackerkb.com
• http://cwe.mitre.org/data/definitions/703.html rapid7:cwe.mitre.org
• https://security.paloaltonetworks.com/json/CVE-2022-0016 rapid7:security.paloaltonetworks.com
• https://www.cve.org/CVERecord?id=CVE-2022-0016 rapid7:www.cve.org
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15237 rapid7:euvd.enisa.europa.eu

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Patch Compliance and Remediation: Technical Guide for IT Pros - JumpCloud
  web:jumpcloud.com

  Master patch compliance with this technical guide covering vulnerability scanning, deployment processes, key metrics, and remediation best practices.

  2026-06-04 07:41 UTC
• NVD - Vulnerabilities
  web:nvd.nist.gov

  Vulnerabilities All vulnerabilities in the NVD have been assigned a CVE identifier and thus, abide by the definition below. CVE defines a vulnerability as: "A weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this ...

  2026-06-04 07:41 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-04 07:41 UTC
• PDF Reducing the Significant Risk of Known Exploited Vulnerabilities
  web:www.cisa.gov

  Organizations across both public and private sectors struggle to find time to test and implement remediations to these vulnerabilities—such as patches and updates—across complex infrastructures. Additionally, the effort and subject matter expertise required to research the degree of risk posed by a given vulnerability makes prioritizing CVEs a challenge.

  2026-06-04 07:41 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-06-04 07:41 UTC
• What To Do If You Can't Patch A Software Vulnerability - Forbes
  web:www.forbes.com

  Mitigation Measures To Take If Patching Isn't Possible Assuming a patch can't be promptly applied, what can be done to mitigate risk? There are several important measures to keep in mind:

  2026-06-04 07:41 UTC
• How to Fix the "Your Device Is Missing Important Security and Quality ...
  web:www.howtogeek.com

  In this case, use your PC's built-in Windows Update troubleshooter to automatically find and fix issues with your updates. Only a little interaction is required from your end. To run that tool, go to Settings > Update & Security > Troubleshoot > Additional Troubleshooters > Windows Update and click "Run the Troubleshooter".

  2026-06-04 07:41 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-06-04 07:41 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-06-04 07:41 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-04 07:41 UTC
• April 2026 Critical Patch Update Released | security - Oracle Blogs
  web:blogs.oracle.com

  For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

  2026-05-17 19:57 UTC
• KB4073119: Windows client guidance for IT Pros to protect against ...
  web:support.microsoft.com

  Provides Windows client guidance for IT Pros to protect against speculative execution side-channel vulnerabilities.

  2026-05-17 19:57 UTC
• KB5089900 - Description of the security update for SQL Server 2022 CU24 ...
  web:support.microsoft.com

  How to obtain or download the latest cumulative update package for Linux To update SQL Server 2022 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command. For installation instructions and direct links to the CU package downloads, see the SQL Server 2022 Release ...

  2026-05-17 19:57 UTC
• BOD 22-01: Reducing the Significant Risk of Known Exploited ... - CISA
  web:www.cisa.gov

  This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency's Binding Operational Directive 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities. A binding operational directive is a compulsory direction to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems ...

  2026-05-17 19:57 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-17 19:57 UTC

Only Available for Registered Users. Sign in to view.