CVE-2024-5921

Status: AnalyzedHigh (7.1)—

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

CVSS

Version: 4.0
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Base score: 7.1

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.46%
Percentile among all scored CVEs: 73
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation60 %
Primary impactT1557 Adversary-in-the-Middlecredential access · collection55 %

Inferred by deterministic rules from the CVSS vector and CWE. Indicative only.

🛡️ ATT&CK mitigations that cover these techniques

User Training Threat Intelligence Program Network Segmentation Network Intrusion Prevention Limit Access to Resource Over Network Filter Network Traffic

Affected technologies (1)

Paloaltonetworks — Globalprotect

CWEs

CWE-295

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2024-5921",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5921",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-27T04:55:17.649111Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.1,
          "Automatable": "NO",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.3.2",
                  "status": "unaffected"
                }
              ],
              "version": "6.3.0",
              "lessThan": "6.3.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.3.2",
                  "status": "unaffected"
                }
              ],
              "version": "6.3.0",
              "lessThan": "6.3.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6-c857",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6-c857",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "macOS"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.1-c31",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.1-c31",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.0",
              "lessThan": "6.1.6",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.1.7",
                  "status": "unaffected"
                }
              ],
              "version": "6.1.0",
              "lessThan": "6.1.7",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iOS"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "unaffected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.1.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "FIPS-CC mode"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "GlobalProtect App",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.2.6",
                  "status": "unaffected"
                }
              ],
              "version": "6.2.0",
              "lessThan": "6.2.6",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows UWP"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-27T04:15:14.687",
  "references": [
    {
      "url": "https://blog.amberwolf.com/blog/2024/november/palo-alto-globalprotect---code-execution-and-privilege-escalation-via-malicious-vpn-server-cve-2024-5921/",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://github.com/AmberWolfCyber/NachoVPN",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2024-5921",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.\n\nPlease subscribe to  our RSS feed https://security.paloaltonetworks.com/rss.xml  to be alerted to new updates to this and other advisories."
    },
    {
      "lang": "es",
      "value": "Un problema de validación de certificación insuficiente en la aplicación GlobalProtect de Palo Alto Networks permite a los atacantes conectar la aplicación GlobalProtect a servidores arbitrarios. Esto puede permitir que un usuario de sistema operativo local no administrativo o un atacante en la misma subred instale certificados raíz maliciosos en el endpoint y, posteriormente, instale software malicioso firmado por los certificados raíz maliciosos en ese endpoint. La aplicación GlobalProtect para Android está en evaluación. Suscríbase a nuestro canal RSS https://security.paloaltonetworks.com/rss.xml para recibir alertas sobre nuevas actualizaciones de este y otros avisos."
    }
  ],
  "lastModified": "2026-06-17T08:16:55.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3359D547-998E-47A1-BEDB-B2C77EF3A409",
              "versionEndExcluding": "6.1.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAD9B8B2-FF04-4DD8-A6CA-36D07E5E143C",
              "versionEndExcluding": "6.1.7",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "481B8617-1E9C-402D-A514-32789504E173",
              "versionEndExcluding": "6.2.1",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98AE3375-3394-4A30-B81C-17AEDF9F6870",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "444E9B22-3CD4-462F-A476-E65CC5307396",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "337C8091-22DB-4449-B042-8325C2FBD956",
              "versionEndExcluding": "6.3.2",
              "versionStartIncluding": "6.3.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37374EC1-2761-4204-B167-81AC7292D6B1",
              "versionEndExcluding": "6.3.2",
              "versionStartIncluding": "6.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}