CVE-2024-2432 is a medium severity privilege escalation in the Palo Alto Networks GlobalProtect app on Windows. A local user who wins a race condition can run programs with elevated rights. NVD scores it 4.5 and the vendor 5.2. Upgrade to 5.1.12, 6.0.8, 6.1.2 or 6.2.1 or later.
What's affected
The Palo Alto Networks advisory lists these Windows versions as affected:
- GlobalProtect 6.2 before 6.2.1
- GlobalProtect 6.1 before 6.1.2
- GlobalProtect 6.0 before 6.0.8
- GlobalProtect 5.1 before 5.1.12
Fixed versions are 5.1.12, 6.0.8, 6.1.2, 6.2.1 and all later Windows releases.
The two scores differ. The NVD record gives CVSS 4.5 (medium). The vendor advisory gives a CVSS-B score of 5.2, also medium, with a suggested urgency of moderate. Neither reads as an emergency, though both describe real risk on shared machines.
How to check if you're exposed
Open the GlobalProtect app on a Windows device and read its version from the About information. Compare it with the list above. For a fleet, use whatever endpoint management tool you already run to report installed versions of the GlobalProtect package, then filter for anything below the fixed release in its branch.
Remember that the flaw is local. The attacker needs an account on the device first, so shared workstations, terminal servers and machines used by contractors deserve attention before single user laptops.
What to do now
- Inventory Windows endpoints running GlobalProtect and record their versions.
- Upgrade each to the fixed release for its branch, or to a later one.
- Prioritise shared and multi user Windows systems.
- Note that the advisory lists no workaround. Upgrading is the only remedy it gives.
Why it matters
The weakness is CWE-269, improper privilege management. The record says execution depends on the local user successfully exploiting a race condition. A race condition means the outcome depends on timing between two operations, so success is not guaranteed on every attempt. That is why the score is lower than for flaws an attacker can trigger reliably.
Local privilege escalation bugs matter because they turn a small foothold into a large one. Malware that lands with ordinary user rights can use one to gain administrative control, and a VPN client usually runs with high privileges by design.
On exploitation, the vendor advisory says Palo Alto Networks knows of no malicious exploitation. It also notes a public proof of concept, recorded on 18 March 2024. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Can someone use this remotely?
No. The advisory describes a local user on a Windows device who must win a race condition.
Is there a workaround?
The advisory lists none. Upgrade to a fixed version.
Sources
- Palo Alto Networks advisory for CVE-2024-2432
- NVD record for CVE-2024-2432
Last reviewed: 19 October 2026.
