What’s Vulnerable › Vulnerabilities

CVE-2025-0126: PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-11 · updated 2026-06-17
• Weakness: CWE-384

Description

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.

Affected products

• Palo Alto Networks PAN-OS: from 11.2.0 before 11.2.3; from 11.1.0 before 11.1.5; from 11.0.0 before 11.0.6; from 10.2.0 before 10.2.10-h6; from 10.1.0 before 10.1.14-h11 — fixed in 10.1.14-h11, 10.2.10-h6, 11.0.6, 11.1.5, 11.2.3
• Palo Alto Networks Prisma Access: from 10.2.0 before 10.2.4-h36; from 11.2.0 before 11.2.4-h5 — fixed in 10.2.4-h36, 11.2.4-h5

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.1.14-h11, 10.2.10-h6, 11.0.6, 11.1.5; Palo Alto Networks Prisma Access 10.2.4-h36, 11.2.4-h5. Check the vendor advisory for mitigations.

References

• https://security.paloaltonetworks.com/CVE-2025-0126

Get alerted when CVE-2025-0126 or the next vulnerability affects your stack