CVE-2025-0126

published 2025-04-11

CVE-2025-0126: When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and…

Priority P3 45 high 8.3 CVSS 4.0

AV N AC L AT N PR N UI A VC N VI L VA H SC H SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V D RE M U Amber

When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.

The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
palo_alto_networks	pan-os	>= 10.1.0 < 10.1.14-h11	10.1.14-h11
palo_alto_networks	pan-os	>= 10.2.0 < 10.2.10-h6	10.2.10-h6
palo_alto_networks	pan-os	>= 11.0.0 < 11.0.6	11.0.6
palo_alto_networks	pan-os	>= 11.1.0 < 11.1.5	11.1.5
palo_alto_networks	pan-os	>= 11.2.0 < 11.2.3	11.2.3
palo_alto_networks	prisma_access	>= 10.2.0 < 10.2.4-h36	10.2.4-h36
palo_alto_networks	prisma_access	>= 11.2.0 < 11.2.4-h5	11.2.4-h5
paloalto	cloud_ngfw	—	—
paloalto	pan-os	—	—
paloalto	prisma_access	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-384