Report feedback

Allows an unauthenticated remote attacker, on PAN-OS and Prisma Access instances with an explicitly configured Simple Certificate Enrollment Protocol (SCEP) authentication feature, to carry out a DoS attack on the firewall using specially crafted packets. If an immediate update to the fixed version is not possible, SCEP can be disabled by entering the command "debug sslmgr set disable-scep-auth-cookie yes" in the PAN-OS CLI. The command must be entered after every restart of the instance [1].

The vulnerability is present in products:

• PAN-OS:PAN-OS;>=10.1,<10.1.14-h11;>=10.2,<10.2.10-h17;>=11.0,<11.0.6;>=11.1,<11.1.5;>=11.2,<11.2.3;
• PAN-OS:Prisma Access;>=10.2.4,<10.2.4-h36;>=10.2.10,<10.2.10-h16;>=11.2.4,<11.2.4-h5;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

More information:

• CVE-2025-0128 at cve.org, NVD
• CWE-754: Improper Check for Unusual or Exceptional Conditions at cwe.mitre.org

The vulnerability was publicly disclosed 9. 4. 2025.

Allows an unauthenticated remote attacker, within GlobalProtect SAML login on PAN-OS and Prisma Access instances with PAN-OS, using social engineering, to fixate the session of a legitimate user, take over their identity and subsequently perform unauthorized actions with their privileges. SAML login for the PAN-OS management interface is not affected. Information on verifying the instance configuration and a temporary fix is available at [2].

The vulnerability is present in products:

• PAN-OS:PAN-OS;>=10.1,<10.1.14-h11;>=10.2,<10.2.4-h25;>=10.2.9,<10.2.9-h13;>=10.2.10,<10.2.10-h6;>=11.0,<11.0.6;>=11.1,<11.1.5;>=11.2,<11.2.3;
• PAN-OS:Prisma Access;>=10.2.4,<10.2.4-h36;>=10.2.10,<10.2.10-h16;>=11.2.4,<11.2.4-h5;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

More information:

• CVE-2025-0126 at cve.org, NVD
• CWE-384: Session Fixation at cwe.mitre.org

The vulnerability was publicly disclosed 9. 4. 2025.

Allows an authenticated local attacker with administrator privileges on PAN-OS VM-Series instances to bypass system restrictions and execute arbitrary commands with root privileges. The vulnerability does not affect already deployed firewalls [3].

The vulnerability is present in product:

• PAN-OS:PAN-OS;>=10.1;<10.1.14-h13;>=10.2,<10.2.9;>=11.0,<11.0.4;

CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

More information:

• CVE-2025-0127 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 4. 2025.

Allows an authenticated local attacker without administrator privileges, by exploiting a race condition in GlobalProtect App on Windows instances, to escalate their privileges to NT AUTHORITY\SYSTEM [4].

The vulnerability is present in product:

• Windows:GlobalProtect App;>=6.0,<6.2.7-h3;>=6.3,<6.3.3;

CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:C/RE:M/U:Amber

More information:

• CVE-2025-0120 at cve.org, NVD
• CWE-250: Execution with Unnecessary Privileges at cwe.mitre.org

The vulnerability was publicly disclosed 9. 4. 2025.

Allows an unauthenticated remote attacker to carry out a DoS attack on Prisma SD-WAN ION devices by sending specially crafted packets [5].

The vulnerability is present in product:

• *:Prisma SD-WAN;>=6.1,<6.1.10;>=6.2,<6.3.4;>=6.4,<6.4.2;>=6.5,<6.5.1;

CVSS: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:A/V:D/RE:L/U:Amber

More information:

• CVE-2025-0122 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 9. 4. 2025.