CVE-2025-0140
Last modified
CVE-2025-0140 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-0140?
How severe is CVE-2025-0140?
How do I fix CVE-2025-0140?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0134A code injection vulnerability in the Palo Alto Networks Cor…6.5
- CVE-2025-0135An incorrect privilege assignment vulnerability in the Palo …3.3
- CVE-2025-0136Using the AES-128-CCM algorithm for IPSec on certain Palo Al…5.3
- CVE-2025-0137An improper input neutralization vulnerability in the manage…4.8
- CVE-2025-0138Web sessions in the web interface of Palo Alto Networks Pris…2
- CVE-2025-0139An incorrect privilege assignment vulnerability in Palo Alto…6.3
- CVE-2025-0141An incorrect privilege assignment vulnerability in the Palo …8.4
- CVE-2025-0142Cleartext storage of sensitive information in the Zoom Jenki…4.3
- CVE-2025-0143Out-of-bounds write in the Zoom Workplace App for Linux befo…6.5
- CVE-2025-0144Out-of-bounds write in some Zoom Workplace Apps may allow an…6.5
- CVE-2025-0145Untrusted search path in the installer for some Zoom Workpla…7.8
- CVE-2025-0146Symlink following in the installer for Zoom Workplace App fo…5
Are you affected by CVE-2025-0140?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST