CVE-2026-0324 · Other
NO FIX YET
The OPSWAT MetaDefender Endpoint Security SDK, bundled with the Palo Alto Networks GlobalProtect app on Windows, has an incorrect privilege management flaw. A local, non-administrative Windows user can escalate to NT AUTHORITY\SYSTEM, the highest local privilege.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Windows machines that run the Palo Alto Networks GlobalProtect app with the OPSWAT MetaDefender Endpoint Security SDK are exposed. The attacker must already have a local, non-administrative user account on that machine. Systems without GlobalProtect on Windows can skip it.
Not affected if no-globalprotect, no-local-user-access, non-windows
Who cares endpoint, globalprotect, opswat, palo-alto-networks, windows
No fix yet, per the sources.
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.