CVE-2024-2432: Privilege Escalation in Palo Alto GlobalProtect

Successful exploitation of CVE-2024-2432 could allow a malicious local user to gain elevated privileges on a Windows system running the vulnerable GlobalProtect app. This could enable them to install malware, modify system configurations, access sensitive data, or compromise the integrity of the entire system. While exploitation requires a race condition, the potential impact is significant, as it bypasses standard user access controls. The attacker would need to be present on the machine and able to trigger the race condition, limiting the scope to local access.

1. Reserved2024-03-13
2. Published2024-03-13
3. Modified2024-08-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-2432 is to upgrade the GlobalProtect app to version 6.2.1 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing stricter local user account controls and monitoring for suspicious process execution. While a direct workaround is not available, limiting the privileges of local user accounts can reduce the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to trigger the race condition and verifying that the elevated privilege execution is blocked.