Critical Vulnerability in Palo Alto GlobalProtect Gateway & Portal Enables Remote Code Execution

Palo Alto Networks has assigned the vulnerability a LOW severity rating but urges administrators to apply patches by upgrading to fixed PAN-OS versions, with timelines extending through August 2025.

Reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks’ GlobalProtect gateway and portal features (CVE-2025-0133) has been disclosed, enabling attackers to execute malicious JavaScript in authenticated users’ browsers.

The flaw impacts PAN-OS firewalls with GlobalProtect enabled and poses risks of phishing and credential theft, particularly for organizations using Clientless VPN.

The vulnerability resides in the handling of user inputs within the GlobalProtect Captive Portal interface.

Attackers can craft malicious links containing JavaScript payloads, which execute in a user’s browser upon interaction.

This occurs only after the user authenticates to the portal, limiting exploitation to authenticated sessions.

Affected configurations include PAN-OS 11.2.x (<11.2.7), 11.1.x (<11.1.11), and 10.2.x (<10.2.17). PAN-OS 10.1.x remains vulnerable indefinitely, as it reaches end-of-life in August 2025.

Organizations using Clientless VPN face heightened risks, as the feature’s design allows attackers to steal session cookies or credentials directly. Palo Alto Networks emphasizes that the vulnerability does not permit tampering with portal configurations or disrupting services.

Severity and Mitigation Strategies

The vulnerability’s CVSSv4 score varies based on configuration: 5.1 (LOW) without Clientless VPN and 6.9 (MEDIUM) with it enabled.

The discrepancy stems from Clientless VPN’s inherent exposure of sensitive data, as outlined in advisory PAN-SA-2025-0005.

Palo Alto recommends immediate upgrades to patched versions:

• PAN-OS 11.2.7+ (available June 2025)
• PAN-OS 11.1.11+ (July 2025)
• PAN-OS 10.2.17+ (August 2025).

For systems awaiting patches, administrators can:

1. Enable Threat IDs 510003 and 510004 via Threat Prevention subscriptions (blocking attacks in Applications and Threats content version 8970).
2. Disable Clientless VPN if unused, eliminating the confidentiality risk vector.

Prisma Access customers are unaffected, as the cloud service automatically blocks exploitation attempts.

Timeline and Proactive Defense Recommendations

The vulnerability was discovered externally by cybersecurity firm XBOW and disclosed on May 14, 2025.

Palo Alto revised advisory on May 21, 2025, clarifying that Prisma Access and Cloud NGFW are no longer impacted.

Enterprises should:

• Audit PAN-OS versions and prioritize upgrades for 11.2.x/11.1.x/10.2.x firewalls.
• Monitor authentication logs for suspicious Captive Portal interactions.
• Educate users on phishing risks, as exploitation requires clicking malicious links.

While active exploitation remains unobserved, the public proof-of-concept (PoC) status raises the likelihood of weaponization.

Organizations using Clientless VPN must treat this vulnerability as high-priority, given its potential to facilitate credential compromise in line with legacy VPN risks.

Palo Alto Networks continues to recommend upgrading end-of-life systems (e.g., PAN-OS 10.1) to supported versions, as no fixes will be released for deprecated platforms.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!