CVE-2024-5915

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Palo Alto Networks	GlobalProtect App	5.1; 6.0; >= 6.1, < 6.1.5; >= 6.2, < 6.2.4; >= 6.3, < 6.3.1
paloaltonetworks	globalprotect	5.1; 6.0; >= 6.1, < 6.1.5; >= 6.2, < 6.2.4; >= 6.3, < 6.3.1

References

https://security.paloaltonetworks.com/CVE-2024-5915Vendor Advisory

Timeline

Published: Aug 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-59164.4An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose CVE-2024-59174.9A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative CVE-2024-59184.3An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted c CVE-2024-59196.5A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to e CVE-2024-59204.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator CVE-2024-59218.8An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect ap CVE-2024-59226.4The Scylla lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode CVE-2024-59248.8Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-We CVE-2024-59256.4The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode CVE-2024-59269.1A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the CVE-2024-59287.8VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala CVE-2024-59297.8VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local a