Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage
Back

CVE-2025-2183

GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation

Description

An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Timeline

  1. ID reserved

    By palo_alto

  2. · 5 months later

    Published

  3. · 7 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-2183, by who scored it
Scored byCVSSScoreVector
palo_altoCNA (assigner)4.0Medium5.3CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amber
NVDNVD · Deferred4.0Medium5.3CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber
EPSS (exploitation in 30 days)
0.13% · top 97% of all CVEs (11 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

What to do

Solution: Version Minor Version Suggested Solution GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.2 Upgrade to 6.3.2-h9 or 6.3.3-h2 or later*. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8 Upgrade to 6.2.8-h3 or later*. GlobalProtect App 6.1 on WindowsUpgrade to 6.2.8-h3 or 6.3.3-h2 or later*. GlobalProtect App 6.0 on Windows Upgrade to 6.2.8-h3 or 6.3.3-h2 or later*. GlobalProtect App 6.3 on Linux 6.3.0 through 6.3.2 Upgrade to 6.3.3 or later*. GlobalProtect App 6.2 on LinuxUpgrade to 6.3.3 or later*.GlobalProtect App 6.1 on LinuxUpgrade to 6.3.3 or later*.GlobalProtect App 6.0 on LinuxUpgrade to 6.3.3 or later*.GlobalProtect App on Android, iOS, macOS No action needed.GlobalProtect UWP App No action needed. * In addition to the software updates listed above, additional steps are required to protect against this vulnerability as described below: Solution for new and existing GlobalProtect app installation on Windows / Linux * Ensure the portal/gateway certificate can be validated using the operating system's certificate store (e.g., Local Machine Certificate Store or Current User Certificate Store in Windows; for Linux, refer to this documentation https://docs.paloaltonetworks.com/globalprotect/6-2/globalprotect-app-user-guide/globalprotect-app-for-linux/support-for-native-certificate-store-for-prisma-access-and-globalprotect-app ). * Remove any certificates associated with portal/gateway validation from the "Trusted Root CA" list on the Portal.  * Enable portal setting: “Enable Strict Certificate Check” (set FULLCHAINCERTVERIFY to yes).

Workaround: No known workarounds exist for this issue.

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References

1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-2183 badge
[![CVE-2025-2183](https://cveledger.app/badge/CVE-2025-2183.svg)](https://cveledger.app/cve/CVE-2025-2183)

Record last updated .