{"id":"CVE-2026-0324","kind":"vulnerability","aliases":["CVE-2026-0324"],"related":[],"title":"OPSWAT MetaDefender SDK in GlobalProtect lets Windows users gain SYSTEM","description":"An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\\SYSTEM.","summary":"The OPSWAT MetaDefender Endpoint Security SDK, bundled with the Palo Alto Networks GlobalProtect app on Windows, has an incorrect privilege management flaw. A local, non-administrative Windows user can escalate to NT AUTHORITY\\SYSTEM, the highest local privilege.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint","globalprotect","opswat","other","palo-alto-networks","windows"],"not_affected_if":["no-globalprotect","no-local-user-access","non-windows"],"how_to_check":"- Check whether the GlobalProtect app is installed on Windows machines in your fleet.\n- Check whether the OPSWAT MetaDefender Endpoint Security SDK is present in the GlobalProtect install directory: unknown if the sources give a path.\n- Check the installed GlobalProtect version against the vendor advisory: unknown if the sources do not give a version range.","fix":null,"status":"open","published_at":"2026-11-11T20:16:59+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:17+00:00","updated_at":"2026-11-11T20:30:17+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T20:30:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OPSWAT MetaDefender SDK in GlobalProtect lets Windows users gain SYSTEM","impact":"high","summary":"The OPSWAT MetaDefender Endpoint Security SDK, bundled with the Palo Alto Networks GlobalProtect app on Windows, has an incorrect privilege management flaw. A local, non-administrative Windows user can escalate to NT AUTHORITY\\SYSTEM, the highest local privilege.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","globalprotect","palo-alto-networks","opswat","endpoint"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains full SYSTEM control of the Windows machine","analyst_note":"Find the vendor advisory and the affected and fixed GlobalProtect and OPSWAT SDK versions, which the NVD entry does not give.","how_to_check":"- Check whether the GlobalProtect app is installed on Windows machines in your fleet.\n- Check whether the OPSWAT MetaDefender Endpoint Security SDK is present in the GlobalProtect install directory: unknown if the sources give a path.\n- Check the installed GlobalProtect version against the vendor advisory: unknown if the sources do not give a version range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-globalprotect","non-windows","no-local-user-access"],"who_is_affected":"Only Windows machines that run the Palo Alto Networks GlobalProtect app with the OPSWAT MetaDefender Endpoint Security SDK are exposed. The attacker must already have a local, non-administrative user account on that machine. Systems without GlobalProtect on Windows can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000791,"input_tokens":4571,"output_tokens":668,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0324':13A,16A '-2026':12A,15A 'administr':52B,94C 'allow':88C 'alto':23B,36B,81C 'app':39B,84C 'authent':91C 'author':59B,103C 'bundl':32B 'cve':11A,14A 'devic':87C 'endpoint':17B,29B,74C 'escal':56B,98C 'flaw':47B 'gain':9A 'globalprotect':5A,18B,38B,83C 'highest':62B 'incorrect':44B,66C 'let':6A 'local':49B,63B,90C 'manag':46B,68C 'metadefend':2A,28B,73C 'network':24B,37B,82C 'non':51B,93C 'non-administr':50B,92C 'nt':58B,102C 'opswat':1A,19B,27B,72C 'palo':22B,35B,80C 'palo-alto-network':21B 'privileg':45B,64B,67C,100C 'sdk':3A,31B,76C 'secur':30B,75C 'system':10A,60B,104C 'use':77C 'user':8A,54B,96C 'vulner':69C 'window':7A,25B,41B,53B,86C,95C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines that run the Palo Alto Networks GlobalProtect app with the OPSWAT MetaDefender Endpoint Security SDK are exposed. The attacker must already have a local, non-administrative user account on that machine. Systems without GlobalProtect on Windows can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoint","globalprotect","medium","opswat","other","paloaltonetworks","windows"],"campaign_type":null,"search_a":"'-0324':13A,16A '-2026':12A,15A 'cve':11A,14A 'gain':9A 'globalprotect':5A 'let':6A 'metadefend':2A 'opswat':1A 'sdk':3A 'system':10A 'user':8A 'window':7A","search_b":"'administr':52B 'alto':23B,36B 'app':39B 'author':59B 'bundl':32B 'endpoint':17B,29B 'escal':56B 'flaw':47B 'globalprotect':18B,38B 'highest':62B 'incorrect':44B 'local':49B,63B 'manag':46B 'metadefend':28B 'network':24B,37B 'non':51B 'non-administr':50B 'nt':58B 'opswat':19B,27B 'palo':22B,35B 'palo-alto-network':21B 'privileg':45B,64B 'sdk':31B 'secur':30B 'system':60B 'user':54B 'window':25B,41B,53B","search_c":"'administr':94C 'allow':88C 'alto':81C 'app':84C 'authent':91C 'author':103C 'devic':87C 'endpoint':74C 'escal':98C 'globalprotect':83C 'incorrect':66C 'local':90C 'manag':68C 'metadefend':73C 'network':82C 'non':93C 'non-administr':92C 'nt':102C 'opswat':72C 'palo':80C 'privileg':67C,100C 'sdk':76C 'secur':75C 'system':104C 'use':77C 'user':96C 'vulner':69C 'window':86C,95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0324","severity":null,"published_at":"2026-11-11T20:16:59+00:00","modified_at":"2026-11-11T20:16:59+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}