CVE-2024-5915: High Local Privilege Escalation in GlobalProtect

CVE-2024-5915 is a local privilege escalation in the Palo Alto Networks GlobalProtect app on Windows. NVD scores it 7.8 (High) and the vendor 5.2 (Medium). Fixed releases are 6.3.1, 6.2.4, 6.1.5 and 6.0.10-c826, with a 5.1 fix expected in December 2024 per the advisory.

What's affected

A local user with low privileges can run programs with elevated privileges through the GlobalProtect app on Windows. The weakness class is CWE-732, incorrect permission assignment for a critical resource. The NVD vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The vendor lists these Windows versions:

• 6.3: affected before 6.3.1
• 6.2: affected before 6.2.4
• 6.1: affected before 6.1.5
• 6.0: affected before 6.0.10-c826
• 5.1: all 5.1.x affected, with a fix expected in December 2024 according to the advisory ETA

Severity conflict. NVD gives 7.8 High. The advisory gives CVSS-B 5.2 Medium with Moderate urgency. The vendor is not aware of malicious exploitation, and the record does not mark it as known exploited.

How to check if you're exposed

Read the GlobalProtect version on each Windows endpoint and match it to the list. On a managed fleet, pull the installed version from your software inventory rather than visiting machines.

To check the workaround, inspect the permissions on the GlobalProtect installation folder and confirm only administrators can write to it:

icacls "C:\Program Files\Palo Alto Networks\GlobalProtect"

The path above is the common default. Confirm it for your install, since the advisory does not give a path.

What to do now

1. Upgrade Windows endpoints to 6.3.1, 6.2.4, 6.1.5 or 6.0.10-c826 or later, depending on your branch.
2. For 5.1 endpoints, plan a move to a supported branch, since the advisory only gives an expected date for a 5.1 fix.
3. Until upgraded, restrict write access to the GlobalProtect installation directory and its contents to Windows administrators.
4. Review which standard users have interactive access to shared or kiosk Windows machines.
5. Verify the folder permissions again after upgrades, since installers can reset them.

Why it matters

Permission mistakes on installed files are a classic route to higher privileges on Windows. A service running as a powerful account loads or touches something a normal user can write, and the user gains that account's power.

The attacker needs a foothold first, so this is a second-stage problem. On shared machines or after phishing, second stages matter. The vendor workaround of locking down the folder is cheap and worth applying while the rollout is in progress.

Quick check

Sources

• Palo Alto Networks advisory for CVE-2024-5915
• NVD record for CVE-2024-5915
• Gold entry

Last reviewed: 19 October 2026.