Technical impact
An improper validation of an ADEM certificate allows an unauthenticated attacker to execute code with NT AUTHORITY\SYSTEM privileges on Windows deployments of Autonomous Digital Experience Manager. The flaw arises because the application does not properly verify the trustworthiness of presented certificates, leading to elevation of privilege to system level when exploited.
Affected Systems
The vulnerability affects Palo Alto Networks Autonomous Digital Experience Manager versions 5.10.0 through 5.10.14 on Windows. Users running any of these releases should confirm their version and consider updating to a patched release.
Risk and Exploitability
The CVSS score of 2.0 reflects a lower severity classification, yet the privilege escalation to SYSTEM is critical. No EPSS score is available. The likely attack vector is an attacker with adjacent network access; this inference comes from the description stating the attacker does not need authentication and must reach the vulnerable service locally or over an internal network. Exploitation requires supplying a malicious or improperly signed certificate to the ADEM instance, after which arbitrary code runs with full system privileges.
