CVE-2022-0017

Description

An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2022-0017 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.

An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.

Overview

State

—

Assigner (CNA)

—

CVSS severity

—

CVSS score

—

CVSS vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Effective score

7.0 / 10 HIGH source: NVD

CWE(s)

—

Reserved

—

Published

2022-02-09 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/palo-alto-networks-globalprotect-app-cve-2022-0017/

Linked Threat

CVE-2022-0017 — GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2022-02-10 18:15:08 UTC

NVD last modified

2026-06-17 04:19:53 UTC

NVD CVSS v3.1

7.0 / 10 HIGH source: psirt@paloaltonetworks.com

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

1.0 / 10

Impact subscore

5.9 / 10

EPSS score

0.0028 (probability of exploitation in next 30 days)

EPSS percentile

19.75% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-59 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-15238

Assigner

palo_alto

Published

Feb 10, 2022, 6:10:18 PM

Updated

Sep 16, 2024, 5:58:01 PM

EUVD base score (CVSS 3.1)

7.0 / 10
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.2800

Vendors

Palo Alto Networks

Products

GlobalProtect App (5.2 <5.2.5)

GlobalProtect App (5.1 <5.1.10)

Aliases

GHSA-fv8p-4m6f-8crp

ENISA description: An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://security.paloaltonetworks.com/CVE-2022-0017 x_refsource_MISC

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• http://cwe.mitre.org/data/definitions/59.html rapid7:cwe.mitre.org
• https://attackerkb.com/topics/CVE-2022-0017 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15238 rapid7:euvd.enisa.europa.eu
• https://security.paloaltonetworks.com/json/CVE-2022-0017 rapid7:security.paloaltonetworks.com
• https://www.cve.org/CVERecord?id=CVE-2022-0017 rapid7:www.cve.org

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Security Updates - Red Hat Customer Portal
  web:access.redhat.com

  Learn about our open source products, services, and company. You are here

  2026-06-04 07:41 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-04 07:41 UTC
• About the security content of iOS 17 and iPadOS 17
  web:support.apple.com

  About the security content of iOS 17 and iPadOS 17 This document describes the security content of iOS 17 and iPadOS 17. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security ...

  2026-06-04 07:41 UTC
• March 13, 2026—Hotpatch KB5084597 (OS Builds 26200.7982 and 26100.7982 ...
  web:support.microsoft.com

  The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change. [Networking] Fixed: This update addresses a security issue in the Windows Routing and Remote Access Service (RRAS) management tool. If you connect to a malicious remote server, an attacker could disrupt the tool or run code on your device. For more ...

  2026-06-04 07:41 UTC
• Vulnerability Patching: Why It's Critical & How to Do It Right
  web:tuxcare.com

  It includes discovering vulnerabilities, evaluating their potential impact, prioritizing remediation efforts (including patching), and confirming the fixes. Patch Management Patch management, on the other hand, is the act of applying the necessary updates to fix known vulnerabilities. It's a critical component of vulnerability management.

  2026-06-04 07:41 UTC
• Microsoft Releases Out-of-Band Security Update to Mitigate ... - CISA
  web:www.cisa.gov

  Updated October 29, 2025: CISA has updated this Alert to include revised information on vulnerable product identification, potential threat activity detections, and additional resources. Microsoft released an update to address a critical remote code execution vulnerability impacting Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022 , and 2025), CVE -2025-59287

  2026-06-04 07:41 UTC
• Determine Fix for IOS XE Software Web UI - Cisco
  web:www.cisco.com

  This document describes a list of software versions that have incorporated fixes for Cisco IOS® XE Software Web UI Cisco bug ID CSCwh87343.

  2026-06-04 07:41 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-06-04 07:41 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-06-04 07:41 UTC
• Oracle Critical Patch Update Advisory - October 2022
  web:www.oracle.com

  Oracle Critical Patch Update Advisory - October 2022 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

  2026-06-04 07:41 UTC
• KB4073119: Windows client guidance for IT Pros to protect against ...
  web:support.microsoft.com

  Provides Windows client guidance for IT Pros to protect against speculative execution side-channel vulnerabilities.

  2026-05-17 19:56 UTC
• Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
  web:www.bleepingcomputer.com

  Microsoft's December 2025 Patch Tuesday fixes 57 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

  2026-05-17 19:56 UTC
• Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
  web:www.bleepingcomputer.com

  Today is Microsoft's October 2025 Patch Tuesday, which includes security updates for 172 flaws, including six zero-day vulnerabilities. Get patching!

  2026-05-17 19:56 UTC
• Microsoft releases Windows 11 OOB hotpatch to fix RRAS RCE flaw
  web:www.bleepingcomputer.com

  Microsoft has released an out-of-band (OOB) update to fix a security vulnerabilities affecting Windows 11 Enterprise devices that receive hotpatch updates instead of the regular Patch Tuesday ...

  2026-05-17 19:56 UTC
• Security Update Guide FAQs - microsoft.com
  web:www.microsoft.com

  These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

  2026-05-17 19:56 UTC
• Microsoft issues SECOND emergency out of band update for Windows 11 to ...
  web:www.windowscentral.com

  Another out of band update has been issued to Windows 11 users to address a major bug that caused Outlook to become inoperable after January's disastrous Patch Tuesday updates.

  2026-05-17 19:56 UTC

Only Available for Registered Users. Sign in to view.