This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Palo Alto Networks fixes 9 vulnerabilities

Palo Alto Networks fixes 9 vulnerabilities in its products. The most severe of them are described below [1][2][3][4][5]; the rest can be found at [6][7][8][9]. Products and their fixed versions: PAN-OS - 11.2.5, 11.1.6-h1, 11.1.7-h2, 11.1.8 [1] - 11.2.7, 11.1.11, 10.2.17 [4] - 11.1.5, 11.0.7, 10.2.11, 10.1.14-h14 [7] - 11.2.5, 11.1.8, 10.2.13, 10.1.14-h14 [8] MetaDefender Endpoint Security SDK - 4.3.4451 (Windows) [2] Cortex XDR Broker VM - 26.0.119 [3][5] GlobalProtect App - 6.3.3, 6.2.8 (macOS) [6] Prisma Cloud Compute Edition - 34.00.141 [9]

Palo Alto Networks PAN-OS - DoS (CVE-2025-0130)
CVSS 8.2 (High)

An unauthenticated remote attacker can, due to a missing check for exceptions in Palo Alto Networks PAN-OS software with the web proxy feature enabled, send batches of maliciously crafted packets and thereby carry out a DoS attack [1].

The vulnerability is present in product:

  • *:PAN-OS; <11.2.5; <11.1.6-h1; <11.1.7-h2; <11.1.8

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber

More information:

The vulnerability was publicly disclosed 14. 5. 2025.

Palo Alto Networks GlobalProtect App - incorrect privilege management (CVE-2025-0131)
CVSS 7.1 (High)

An authenticated local attacker can, due to incorrect privilege management in the OPSWAT MetaDefender Endpoint Security SDK component used by the Palo Alto Networks GlobalProtect app on Windows devices, escalate their privileges to NT AUTHORITY\SYSTEM [2].

The vulnerability is present in product:

  • *:GlobalProtect App; <6.3.3; <6.2.8

CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/U:Amber

More information:

The vulnerability was publicly disclosed 14. 5. 2025.

Palo Alto Networks Cortex XDR Broker VM - missing authentication (CVE-2025-0132)
CVSS 6.9 (Medium)

An unauthenticated remote attacker with network access to the device can disable certain internal services due to missing authentication in Palo Alto Networks Cortex XDR Broker VM [3].

The vulnerability is present in product:

  • *:Cortex XDR Broker VM; < 26.0.119

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 14. 5. 2025.

Palo Alto Networks PAN-OS - reflected XSS (CVE-2025-0133)
CVSS 6.9 (Medium)

An unauthenticated remote attacker can, due to a reflected XSS vulnerability in the GlobalProtect portal and gateway, run malicious JavaScript in the browser of an authenticated user, which may lead to credential theft, especially when Clientless VPN is enabled [4].

The vulnerability is present in product:

  • *:PAN-OS; >=11.2.0, <11.2.7, >=11.1.0, <11.1.11; >=10.2.0, <10.2.17

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:M/U:Amber

More information:

  • CVE-2025-0133 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 5. 2025.

Palo Alto Networks Cortex XDR Broker VM - arbitrary code execution (CVE-2025-0134)
CVSS 6.5 (Medium)

An authenticated user can execute arbitrary code with root privileges on the host operating system in Palo Alto Networks Cortex XDR Broker VM [5].

The vulnerability is present in product:

  • *:Cortex XDR Broker VM; 26.0.0, <26.0.119

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 14. 5. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 19. 5. 2025.

CESNET, z.s.p.o. Logo