This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Palo Alto fixes 7 vulnerabilities in various products

Palo Alto Networks fixes seven vulnerabilities in its products. The most severe of them are described below [1][2][3][4]; the remaining ones can be found at [5][6][7]. Products and their fixed versions: PAN-OS [1][3][4] - 10.1.14-h16 (07/2025), 10.2.16-h1 (06/2025), 10.2.17 (08/2025) - 11.0.3, 11.1.10, 11.2.7 (06/2025) GlobalProtect App (Windows, macOS) - 6.3.3, 6.3.3-650, 6.2.8-h2 (06/2025) [2] Prisma Access Browser - 137.16.2.69 [5] Cortex XDR Broker VM - 27.0.26 [6]

Palo Alto PAN-OS - command injection (CVE-2025-4231)
CVSS 8.6 (High)

An authenticated remote attacker with administrator privileges in the PAN-OS web management interface can perform a command injection attack and carry out actions as root [1]. The risk of the attack can be significantly reduced by restricting access to the management interface to trusted internal IP addresses only, as recommended at [8]. Detailed information on the specific configuration of vulnerable instances and on risk mitigation options can be found at [1].

The vulnerability is present in product:

  • PAN-OS; >=10.1.0, <=10.1.14; >=10.2.0, <=10.2.7; >=11.0.0, <=11.0.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber

More information:

  • CVE-2025-4231 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

Palo Alto GlobalProtect App (macOS) - privilege escalation (CVE-2025-4232)
CVSS 8.5 (High)

An authenticated local attacker on macOS can escalate their privileges to root level in GlobalProtect App through incorrect interpretation of wildcards in the log collection component [2].

The vulnerability is present in product:

  • GlobalProtect App (macOS); >=6.2.0, <= 6.2.8-223; >=6.3.0, <=6.3.2;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

More information:

The vulnerability was publicly disclosed 11. 6. 2025.

Palo Alto PAN-OS - OS command injection (CVE-2025-4230)
CVSS 8.4 (High)

An authenticated local attacker with administrator privileges and access to the PAN-OS command line can bypass the system's security restrictions and run arbitrary commands as root [3]. The risk can be significantly reduced by restricting CLI access to trusted administrators only.

The vulnerability is present in product:

  • PAN-OS; >=10.1.0, <=10.1.14; >=10.2.0, <=10.2.13; >=11.1.0, <=11.1.9; >=11.2.0, <=11.2.5;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:D/U:Amber

More information:

  • CVE-2025-4230 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

Palo Alto PAN-OS - traffic information disclosure (CVE-2025-4229)
CVSS 6.0 (Medium)

An unauthenticated remote attacker can gain access to unencrypted data sent from the firewall through an SD-WAN interface with the Direct Internet Access feature active. Detailed information on the specific configuration of vulnerable instances and on temporary workaround options can be found at [4].

The vulnerability is present in product:

  • PAN-OS; >=10.1.0, <=10.1.14; >=10.2.0, <=10.2.16; >=11.1.0, <=11.1.9; >=11.2.0, <=11.2.6;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amber

More information:

  • CVE-2025-4229 at cve.org, NVD
  • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere at cwe.mitre.org

The vulnerability was publicly disclosed 11. 6. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 18. 6. 2025.

CESNET, z.s.p.o. Logo