Multiple improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect App versions 6.2.0 and 6.3.0 enable an attacker with local or same-subnet access to redirect encrypted traffic to unauthorized servers, potentially facilitating malicious software installation. The vulnerability is tracked as CWE-295 and affects only these specific versions of the GlobalProtect App, excluding Linux, Windows, iOS, and UWP variants. The CVSS 4.0 base score is 4.9, indicating medium severity with attack vector local, low attack complexity, and partial impact on confidentiality and integrity.

An attacker who is either a local non-administrative user or positioned on the same network subnet can exploit this vulnerability to intercept and redirect encrypted communications from the affected GlobalProtect App versions. This interception can lead to the installation of malicious software on the endpoint. However, the impact is limited by the requirement for local or same-subnet access and the absence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Palo Alto Networks, users should monitor vendor communications for updates. Until a patch is available, restrict local and subnet access to trusted users and networks to reduce exposure.