CVE-2025-4227

published 2025-06-13

CVE-2025-4227: An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-fe…

Priority P4 12 low 3.5 CVSS 3.1

AV P AC L PR N UI N S U C L I L A N

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel.

An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
palo_alto_networks	globalprotect_app	—	—
palo_alto_networks	globalprotect_app	—	—
palo_alto_networks	globalprotect_app	>= 6.2.0 < 6.2.8-h2	6.2.8-h2
palo_alto_networks	globalprotect_app	>= 6.3.0 < 6.3.2-566	6.3.2-566
paloalto	globalprotect_app	—	—
paloaltonetworks	globalprotect	>= 6.0.0 < 6.2.8	6.2.8
paloaltonetworks	globalprotect	>= 6.3.0 < 6.3.3	6.3.3

CVSS provenance

nvd v3.1 3.5 LOW CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

nvd v4.0 1.0 LOW CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Green

vendor_oracle 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-319