CVE-2026-0323: Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability
CVE-2026-0323
Summary
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.
Products covered
MetaDefender Endpoint Security SDK
MetaDefender Endpoint Security SDK 4.3.0
Remediation
This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4822 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK):
Version | Minor Version | Suggested Solution |
|---|---|---|
GlobalProtect App 6.3 on Windows | 6.3.0 through 6.3.3-h2 | Upgrade to 6.3.3-h3 (6.3.3-711) or later. |
GlobalProtect App 6.2 on Windows | 6.2.0 through 6.2.8-h3 | Upgrade to 6.2.8-h4 (6.2.8-317) or later. |
GlobalProtect App on macOS | No action needed. | |
GlobalProtect App on Linux | No action needed. | |
GlobalProtect App on iOS | No action needed. | |
GlobalProtect App on Android | No action needed. | |
GlobalProtect UWP App | No action needed. |
Vendor-listed fixes
MetaDefender Endpoint Security SDK 4.3.0 >= 4.3.4822 on Windows
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.