Vulnerability in Palo Alto Networks Cloud Ngfw
CVE-2025-0126
When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker. The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (31.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Palo Alto Networks Cloud Ngfw — versions All
- Palo Alto Networks Pan-Os — versions 11.2.0, 11.1.0, 11.0.0
- Palo Alto Networks Prisma Access — versions 10.2.0, 11.2.0
Weakness classification (CWE)
References
- security.paloaltonetworks.com/CVE-2025-0126 (vendor-advisory)