PT-2025-16006 · Palo Alto Networks · Globalprotect

Dangelo Gonzalez · Published 2025-04-09 · Updated 2025-04-23 · CVE-2025-0126

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions: GlobalProtect versions (affected versions not specified)

Description: A session fixation issue in the GlobalProtect login, when configured using SAML, allows an attacker to impersonate a legitimate authorized user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma Access instances.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2025-04902

CVE-2025-0126

Affected Products

Globalprotect

References · 14

• https://bdu.fstec.ru/vul/2025-04902 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0126 · Security Note
• https://security.paloaltonetworks.com/CVE-2025-0126 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1910531349582164318 · Twitter Post
• https://t.me/cvetracker/21359 · Telegram Post
• https://twitter.com/cybercronai/status/1911003994274594982 · Twitter Post
• https://twitter.com/CveFindCom/status/1910521081133146376 · Twitter Post
• https://twitter.com/CVETracker/status/1910785109726224557 · Twitter Post
• https://twitter.com/cybercronai/status/1910735983177236638 · Twitter Post
• https://twitter.com/CCBalert/status/1915042254256800235 · Twitter Post
• https://t.me/cvedetector/22699 · Telegram Post
• https://t.me/latest_high_impact_cve/2126 · Telegram Post
• https://twitter.com/CVEnew/status/1910556900590055542 · Twitter Post
• https://reddit.com/r/paloaltonetworks/comments/1jw09bo/new_palo_alto_networks_security_advisories_for · Reddit Post