# CVE-2024-5921: GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation

- Exploited (CISA KEV): no
- Published: 2024-11-27
- CVSS: 6 MEDIUM (v4.0)
- EPSS: 1.5% (73th percentile)
- CWE: CWE-295

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to  our RSS feed https://security.paloaltonetworks.com/rss.xml  to be alerted to new updates to this and other advisories.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-01-06 | 40 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-01-06 · new · rule fa49213e55484f6c824e0682a5260b70 · default Block
  > Palo Alto GlobalProtect - Remote Code Execution - CVE:CVE-2024-5921. Previous action: Log. New action: Block. New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-01-06-waf-release/

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-5921 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-5921