CVE-2025-2179
📛 CVE Title
GlobalProtect App: Non Admin User Can Disable the GlobalProtect App
Description
An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- palo_alto
- CVSS severity
- MEDIUM
- CVSS score
- 6.8 / 10
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber- Effective score
- 6.8 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-266 - Reserved
- 2025-03-10
- Published
- 2025-07-29 19:15 UTC
- Last updated
- 2025-07-29 19:37 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/2xxx/CVE-2025-2179.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2025-07-29 18:15:27 UTC
- NVD last modified
- 2026-06-17 09:06:28 UTC
- EPSS score
- 0.0013 (probability of exploitation in next 30 days)
- EPSS percentile
- 2.72% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27
NVD / KEV / EPSS data refreshed 2026-07-27 14:50 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2025-23021 - Assigner
- palo_alto
- Published
- Jul 29, 2025, 5:15:08 PM
- Updated
- Jul 29, 2025, 5:37:23 PM
- EUVD base score (CVSS 4.0)
-
6.8 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber - EUVD-reported EPSS
- 0.0700
- Vendors
- Palo Alto Networks
- Products
-
GlobalProtect App (6.2.0 <6.2.9)GlobalProtect App (6.0.0)GlobalProtect AppGlobalProtect App (6.1.0)GlobalProtect UWP App
- Aliases
-
GHSA-g28w-j37r-vf7q
ENISA description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
EUVD references (1)
Affected products (3)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
6.2.0 (affected),
6.1.0 (affected),
6.0.0 (affected)
|
Linux |
| Palo Alto Networks | GlobalProtect App |
All (unaffected)
|
Android, Chrome OS, iOS, Windows, macOS |
| Palo Alto Networks | GlobalProtect UWP App |
All (unaffected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://security.paloaltonetworks.com/CVE-2025-2179 vendor-advisory
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://security.paloaltonetworks.com/CVE-2025-2179 vendor-advisory
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/266.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2025-2179 rapid7:attackerkb.com
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23021 rapid7:euvd.enisa.europa.eu
- https://security.paloaltonetworks.com/json/CVE-2025-2179 rapid7:security.paloaltonetworks.com
- https://www.cve.org/CVERecord?id=CVE-2025-2179 rapid7:www.cve.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://security.paloaltonetworks.com/CVE-2025-2179 psirt@paloaltonetworks.com
Remediations (10)
-
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 13:58 UTC -
web:thecyberexpress.com
Microsoft Patch Tuesday July 2025 was the busiest since January, with 130 vulnerabilities fixed - including 17 high-risk ones.
2026-05-23 13:58 UTC -
web:www.action1.com
This Patch Tuesday brings 55 vulnerability fixes from Microsoft, including six zero-days. Third-party overview includes actively exploited vulnerabilities in web browsers, Cisco, Fortinet, ServiceNow, Palo Alto, SAP, WordPress, Adobe, Oracle, and many more.
2026-05-23 13:58 UTC -
web:www.computerworld.com
Here's a look at the most recent Patch Tuesday release from Microsoft as well as a collection of recent updates so you can track what's changed.
2026-05-23 13:58 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.
2026-05-23 13:58 UTC -
web:www.esri.com
Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.
2026-05-23 13:58 UTC -
web:www.lansweeper.com
The July 2025 edition of Patch Tuesday brings us 137 new fixes, with 14 rated as critical. We've listed the most important changes below. Microsoft SQL Server Remote Code Execution Vulnerability CVE - 2025 -49717, is a heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
2026-05-23 13:58 UTC -
web:www.neowin.net
Microsoft has released Patch Tuesday updates for Windows 11 KB5074109, KB5073455 for January 2026. Here's what's included.
2026-05-23 13:58 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-23 13:58 UTC -
web:www.windowslatest.com
Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.
2026-05-23 13:58 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2025-2179.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-29T17:37:10.712988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-29T17:37:23.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.1.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.2.9",
"status": "unaffected"
}
],
"lessThan": "6.2.9",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android",
"Chrome OS",
"iOS",
"Windows",
"macOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GlobalProtect UWP App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>You are vulnerable to this issue if you have GlobalProtect configured with both of the following configurations:</p><p></p><ol><li>Connect method set to 'Every time the user logs on to the machine (Always On)'</li><li>'Allow User to Disable GlobalProtect' set to either Disallow or 'Allow with Passcode'</li></ol><p></p><p>You can verify if these configurations are enabled by either</p><ol><li>Navigating to GlobalProtect > App Settings - GlobalProtect on the Strata Cloud Manager OR</li><li>Navigating to Network > GlobalProtect > Portals > Agent on Panorama or PAN-OS management web interface for directly-managed devices.</li></ol>"
}
],
"value": "You are vulnerable to this issue if you have GlobalProtect configured with both of the following configurations:\n\n\n\n * Connect method set to 'Every time the user logs on to the machine (Always On)'\n * 'Allow User to Disable GlobalProtect' set to either Disallow or 'Allow with Passcode'\n\n\nYou can verify if these configurations are enabled by either\n\n * Navigating to GlobalProtect > App Settings - GlobalProtect on the Strata Cloud Manager OR\n * Navigating to Network > GlobalProtect > Portals > Agent on Panorama or PAN-OS management web interface for directly-managed devices."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Bourla"
},
{
"lang": "en",
"type": "finder",
"value": "Graham Brereton (graham.brereton@form3.tech)"
}
],
"datePublic": "2025-07-28T21:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect\u2122 App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.<br><br>The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected."
}
],
"value": "An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect\u2122 App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.\n\nThe GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-578",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-578 Disable Security Software"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-29T17:15:08.461Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2025-2179"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>GlobalProtect App 6.2 on Linux<br></td>\n <td>6.2.0 through 6.2.8</td>\n <td>Upgrade to 6.2.9 or later.</td>\n </tr><tr><td>GlobalProtect App 6.1 on Linux</td><td></td><td>Upgrade to 6.2.9 or later.</td></tr><tr><td>GlobalProtect App 6.0 on Linux</td><td></td><td>Upgrade to 6.2.9 or later.</td></tr><tr><td>GlobalProtect App on Android, ChromeOS, iOS, macOS, Windows<br></td><td></td><td>No action needed.</td></tr></tbody></table>"
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n GlobalProtect App 6.2 on Linux\n\n 6.2.0 through 6.2.8\n Upgrade to 6.2.9 or later.\n GlobalProtect App 6.1 on LinuxUpgrade to 6.2.9 or later.GlobalProtect App 6.0 on LinuxUpgrade to 6.2.9 or later.GlobalProtect App on Android, ChromeOS, iOS, macOS, Windows\nNo action needed."
}
],
"source": {
"defect": [
"GPC-21751"
],
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2025-07-28T19:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "GlobalProtect App: Non Admin User Can Disable the GlobalProtect App",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No workaround or mitigation is available."
}
],
"value": "No workaround or mitigation is available."
}
],
"x_affectedList": [
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.1.7",
"GlobalProtect App 6.1.6",
"GlobalProtect App 6.1.5",
"GlobalProtect App 6.1.4",
"GlobalProtect App 6.1.3",
"GlobalProtect App 6.1.2",
"GlobalProtect App 6.1.1",
"GlobalProtect App 6.1.0",
"GlobalProtect App 6.1",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2025-2179",
"datePublished": "2025-07-29T17:15:08.461Z",
"dateReserved": "2025-03-10T17:56:18.225Z",
"dateUpdated": "2025-07-29T17:37:23.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}