An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtectâ„¢ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No known workarounds or mitigations exist for this issue.

History

Wed, 11 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Description An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtectâ„¢ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Title GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows
First Time appeared Opswat
Opswat metadefender Endpoint Security Sdk
Weaknesses CWE-266
CPEs cpe:2.3:a:opswat:metadefender_endpoint_security_sdk:*:*:*:*:*:Windows:*:*
Vendors & Products Opswat
Opswat metadefender Endpoint Security Sdk
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-11-11T20:02:33.834Z

Reserved: 2025-11-03T20:46:26.182Z

Link: CVE-2026-0324

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T20:16:59.480

Modified: 2026-11-11T20:16:59.480

Link: CVE-2026-0324

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses