CVE-2025-0126

PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

Published Apr 11, 2025 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.

The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Palo Alto Networks

Cloud NGFW

unaffected

Version	Status	Constraints
`All`	unaffected	—

Palo Alto Networks

PAN-OS

unaffected

Version	Status	Constraints
`11.2.0`	affected	< 11.2.3
`11.1.0`	affected	< 11.1.5
`11.0.0`	affected	< 11.0.6
`10.2.0`	affected	< 10.2.10-h6
`10.1.0`	affected	< 10.1.14-h11

Palo Alto Networks

Prisma Access

unaffected

Version	Status	Constraints
`10.2.0`	affected	< 10.2.4-h36
`11.2.0`	affected	< 11.2.4-h5

No data.

No data available yet.

Remediation

Vendor Workaround

This issue can be mitigated using a different form of authentication for the GlobalProtect portal (such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos). For more information about configuring authentication for the GlobalProtect portal see this technical documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab .

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-15135	When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.412% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2025-0126

History

Apr 11, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 11, 2025 2:15 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.
Title		PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login
First Time appeared		Paloaltonetworks Paloaltonetworks pan-os
Weaknesses		CWE-384
CPEs		cpe:2.3:o:paloaltonetworks:pan-os:10.1.0:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.12:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.13:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h10:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h7:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h9:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.1.1:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.2:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.7:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h11:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h12:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h13:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h14:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h15:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h16:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h17:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h18:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h19:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h1:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h20:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h21:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h22:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h23:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h24:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h25:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h26:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h27:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h28:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h29:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h30:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h31:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h32:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h5:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h6:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h7:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h8:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h9:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:::::::* cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h10:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:::::: cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:::::: cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:::::::* cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:::::::*
Vendors & Products		Paloaltonetworks Paloaltonetworks pan-os
References		https://security.paloaltonetworks.com/CVE-2025-0126
Metrics		cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber'}`