An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administra...| security.paloaltonetworks.com
Summary This article delves into vulnerabilities in the Palo Alto GlobalProtect VPN client discovered by Michelin Red Team (Yassine Bengana and Myself) and identified as CVE-2024-5921, CVE-2025-0117, CVE-2025-0118 & CVE-2025-2183. We will see how they enable an attacker to execute code on Windows GlobalProtect clients located in the same network. The| Michelin IT Engineering Blog