SecBoard
Zurück zur CVE-Übersicht

CVE-2026-0307

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.

Erkennung & Indikatoren

Ausnutzung

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Behobene Versionen

  • GlobalProtect App 6.3.3-h15 on Linux
  • GlobalProtect App 6.0.15 on Linux
  • GlobalProtect App 6.3.3-h15 on macOS
  • GlobalProtect App 6.2.8-h14 on macOS
  • GlobalProtect App 6.0.15 on macOS
  • GlobalProtect App 6.3.3-h15 on Windows
  • GlobalProtect App 6.2.8-h14 on Windows
  • GlobalProtect App 6.0.15 on Windows
  • PAN-OS 12.2.3
  • PAN-OS 12.1.10
  • PAN-OS 12.1.7-h5
  • PAN-OS 12.1.4-h10
  • PAN-OS 11.2.13-h2

Threat-Hunting-Queries

Detects attempts by a low-privileged user to execute commands with elevated privileges, indicative of a local privilege escalation. This query focuses on process creation events where a non-system user account spawns a process that then executes with SYSTEM/root privileges.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessAccountName !contains "SYSTEM" and InitiatingProcessAccountName !contains "root"
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash", "zsh")
| where ProcessCommandLine contains "runas" or ProcessCommandLine contains "sudo"
| where AccountName contains "SYSTEM" or AccountName contains "root"

Splunk SPL

index=* (sourcetype=WinEventLog:Security OR sourcetype=linux_audit)
| where (EventCode=4688 OR EventCode=1) AND NOT (User="NT AUTHORITY\\SYSTEM" OR User="root")
| where (NewProcessName="cmd.exe" OR NewProcessName="powershell.exe" OR NewProcessName="sh" OR NewProcessName="bash" OR NewProcessName="zsh")
| where (CommandLine LIKE "%runas%" OR CommandLine LIKE "%sudo%")
| where (ParentProcessUser="NT AUTHORITY\\SYSTEM" OR ParentProcessUser="root")

Sigma

title: GlobalProtect Local Privilege Escalation Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects attempts by a low-privileged user to execute commands with elevated privileges via GlobalProtect app, indicative of a local privilege escalation.
author: SecBoard
date: 2026/09/09
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentProcessName|endswith:
      - '\GlobalProtect.exe'
    User|contains:
      - 'NT AUTHORITY\SYSTEM'
      - 'root'
    InitiatingProcessAccountName|!contains:
      - 'NT AUTHORITY\SYSTEM'
      - 'root'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh'
      - '\bash'
      - '\zsh'
  condition: selection
level: high

Elastic ES|QL

from process where event.type == "start" and 
  process.parent.executable : "*\\GlobalProtect.exe" and 
  (user.name : "NT AUTHORITY\\SYSTEM" or user.name : "root") and 
  not (process.parent.user.name : "NT AUTHORITY\\SYSTEM" or process.parent.user.name : "root") and 
  (process.executable : "*\\cmd.exe" or process.executable : "*\\powershell.exe" or process.executable : "*\\sh" or process.executable : "*\\bash" or process.executable : "*\\zsh")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen