CVE-2024-5908 is a credential exposure in the Palo Alto Networks GlobalProtect app. Encrypted credentials used to connect can be written to application logs, which people share when troubleshooting. NVD scores it 7.5 (High), the vendor 5.5 (Medium). Fixed releases exist on the 5.1, 6.0, 6.1 and 6.2 branches.
What's affected
The record describes a problem where encrypted user credentials for GlobalProtect appear in the app logs. Those logs are normally readable only by local users, but they are bundled when someone generates a troubleshooting package, so anyone who receives that package could see the values. The weakness is CWE-532, insertion of sensitive information into a log file.
From the vendor advisory, the affected and fixed releases are:
- 6.2: Windows and macOS before 6.2.3 are affected, fixed in 6.2.3. Linux releases are not affected.
- 6.1: Windows, macOS and Linux before 6.1.3 are affected, fixed in 6.1.3. Android and iOS are not affected.
- 6.0: Windows and macOS before 6.0.8 are affected, fixed in 6.0.8. All Linux releases are affected.
- 5.1: Windows and macOS before 5.1.12 are affected, fixed in 5.1.12. All Linux releases are affected.
Severity conflict. NVD scores it 7.5 High with a network vector and high confidentiality impact. The vendor gives CVSS-B 5.5 (Medium) and Moderate urgency. The vendor is not aware of malicious exploitation, and the CVE is not marked as known exploited in the record.
How to check if you're exposed
On each endpoint, find the GlobalProtect app version in the app settings and compare it with the list above.
Then look at where support bundles have been sent. The log file named in the advisory workaround is PanGPA.log in the GlobalProtect installation directory. Any copy of that file, or of a bundle that contains it, may hold the exposed values.
What to do now
- Upgrade GlobalProtect to a fixed release for your branch.
- Delete the
PanGPA.logfiles from the GlobalProtect installation directory on all endpoints, as the advisory suggests. - Force a rotation of the passwords users use to connect to GlobalProtect.
- Search tickets, email and shared drives for troubleshooting bundles from affected endpoints and remove or restrict them.
- Add a step to your support process: check what a log bundle contains before it leaves the company.
Why it matters
Logging bugs are easy to miss because the application works normally. Here the sensitive value is encrypted, which sounds safe, but the advisory still treats it as a problem worth rotating passwords over, so do not treat the encryption as a reason to relax.
The real exposure path is human. Log bundles get attached to support tickets and forwarded to vendors, contractors and chat channels. A VPN credential in that bundle turns a routine support request into an access risk.
Quick check
Is a software update enough?
The vendor presents log deletion and password rotation as protection against the impact of past exposure. Upgrading is the remediation going forward.
Which platforms are not affected?
Per the advisory, Linux on 6.2 and Android and iOS on 6.1 are not affected, while Linux on 6.1, 6.0 and 5.1 is listed as affected.
Sources
- Palo Alto Networks advisory for CVE-2024-5908
- NVD record for CVE-2024-5908
- Gold entry
Last reviewed: 19 October 2026.
