GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

A locally authenticated user on a macOS system running the GlobalProtect client could exploit a race condition to gain root-level access, allowing them to modify VPN configuration, intercept traffic, or compromise the entire endpoint.

Organizations whose employees use macOS laptops with Palo Alto GlobalProtect VPN client. IT teams managing remote workforce endpoints, particularly those in utilities, water authorities, and critical infrastructure where remote access is required. This affects workstations and laptops, not OT servers or embedded systems.

An attacker with a local user account on a macOS machine must wait for a specific timing window during GlobalProtect app startup or operation, then execute a race condition attack to replace or modify system files that the app accesses with elevated privileges. Once the race condition is triggered, the attacker gains root-level code execution.