Remote Code Execution Vulnerability in Palo Alto Networks GlobalProtect on Windows

CVE-2025-0118

Summary

A vulnerability exists in the Palo Alto Networks GlobalProtect application on Windows that could allow a remote attacker to execute ActiveX controls within the session of an authenticated user. By navigating to a malicious web page during the SAML login process, an attacker could potentially execute unauthorized commands under the privileges of an authenticated user. This issue is specific to the Windows version, and users of other operating systems are not affected.

References