GlobalProtect for Windows Fixes Local SYSTEM Privilege Escalation
Tech GuruQuick Answer
Update the Windows GlobalProtect app to the supported fixed build for its branch. Verify the installed app and SDK, test VPN and endpoint checks, and retain deployment and local-access evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Confirm Windows, the full GlobalProtect build and embedded SDK. No special configuration is required; exploitation requires an existing local user account. Deploy the applicable fixed GlobalProtect package using the supported endpoint rollout process. Palo Alto Networks lists no workaround. Verify the full app build, SDK version and a fresh VPN connection; test host information profile checks and device-management compatibility.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GlobalProtect App on Windows with OPSWAT MetaDefender Endpoint Security SDK |
|---|---|
| Advisory | CVE-2026-0324 |
| CVE | CVE-2026-0324 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | MetaDefender Endpoint Security SDK 4.3.0 through versions before 4.3.4822 on Windows. GlobalProtect Windows 6.3.0 through 6.3.3-h2 and 6.2.0 through 6.2.8-h3 are listed for remediation. The vendor lists no action for macOS, Linux, iOS, Android or UWP. |
| Fixed version | GlobalProtect Windows 6.3.3-h3 (6.3.3-711) or 6.2.8-h4 (6.2.8-317), or later; these include SDK 4.3.4822 or later |
| CVSS base score | 8.5 (CVSS v4.0 base score) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
A local, authenticated Windows user without administrator rights can obtain SYSTEM privileges through the embedded OPSWAT SDK.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Confirm Windows, the full GlobalProtect build and embedded SDK. No special configuration is required; exploitation requires an existing local user account.
- Remediate. Deploy the applicable fixed GlobalProtect package using the supported endpoint rollout process. Palo Alto Networks lists no workaround.
- Validate. Verify the full app build, SDK version and a fresh VPN connection; test host information profile checks and device-management compatibility.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate remote-user connectivity and preserve local authentication and endpoint telemetry. Do not treat all GlobalProtect platforms as affected.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| MetaDefender Endpoint Security SDK 4.3.0 | < 4.3.4822 on Windows | >= 4.3.4822 on Windows |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
