CVE-2026-0324

GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows

Published Nov 11, 2026 CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

Remediation

Vendor Workaround

No known workarounds or mitigations exist for this issue.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Title GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows
First Time appeared Opswat
Opswat metadefender Endpoint Security Sdk
Weaknesses CWE-266
CPEs cpe:2.3:a:opswat:metadefender_endpoint_security_sdk:*:*:*:*:*:Windows:*:*
Vendors & Products Opswat
Opswat metadefender Endpoint Security Sdk
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
palo_alto
Published
Updated
Nov 11, 2026, 8:02 PM
Reserved
Nov 3, 2025, 8:46 PM
Status
Awaiting Analysis
Published
Nov 11, 2026, 8:16 PM
Modified
Nov 12, 2026, 7:02 PM