Medium severity · published Aug 13, 2025
CVE-2025-2183
GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
GlobalProtect App · Palo Alto Networks
6.3.0 before 6.3.3-h2 (6.3.3-c676); 6.2.0 before 6.2.8-h3 (6.2.8-c263); 6.1.0; 6.0.0; 6.3.0 before 6.3.3; 6.2.0 before 11.1.10; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2183
security.paloaltonetworks.com
https://security.paloaltonetworks.com/CVE-2025-2183
More from GlobalProtect App
8.8
CVE-2025-4232
GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
8.8
CVE-2024-5921
GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation
8.4
CVE-2025-0141
GlobalProtect App: Privilege Escalation (PE) Vulnerability
8.1
CVE-2026-0298
GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)
8.1
CVE-2026-0297
GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake