CVE-2025-0126 PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login
Description
When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.
The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 11.2 | < 11.2.3 | >= 11.2.3 |
| PAN-OS 11.1 | < 11.1.5 | >= 11.1.5 |
| PAN-OS 11.0 | < 11.0.6 | >= 11.0.6 |
| PAN-OS 10.2 | < 10.2.4-h25 < 10.2.9-h13 < 10.2.10-h6 < 10.2.11 | >= 10.2.4-h25 >= 10.2.9-h13 >= 10.2.10-h6 >= 10.2.11 |
| PAN-OS 10.1 | < 10.1.14-h11 | >= 10.1.14-h11 |
| Prisma Access | < 10.2.4-h36 on PAN-OS < 10.2.10-h16 on PAN-OS < 11.2.4-h5 on PAN-OS | >= 10.2.4-h36 on PAN-OS >= 10.2.10-h16 on PAN-OS >= 11.2.4-h5 on PAN-OS |
PAN-OS 11.0, PAN-OS 10.0, PAN-OS 9.1, PAN-OS 9.0, and older releases have reached their software end-of-life (EoL) dates and are no longer evaluated for vulnerabilities and no fixes are planned. These versions are presumed to be affected.
Required Configuration for Exposure
This issue impacts only firewalls on which you configured a GlobalProtect portal to use SAML Authentication.
You can verify whether you configured GlobalProtect portal by checking for entries in your firewall web interface (Network → GlobalProtect → Portals).
If you do have GlobalProtect portals or gateways in your configuration, then you can verify whether you configured SAML Authentication on these portals by checking your firewall web interface (Network → GlobalProtect → Portals → (portal-config) → Authentication).
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 5.6 / CVSS-B: 8.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:H/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| PAN-OS 11.2 | 11.2.0 through 11.2.2 | Upgrade to 11.2.3 or later |
| PAN-OS 11.1 | 11.1.0 through 11.1.4 | Upgrade to 11.1.5 or later |
| PAN-OS 11.0 | 11.0.0 through 11.0.5 | Upgrade to 11.0.6 or later |
| PAN-OS 10.2 | 10.2.10 | Upgrade to 10.2.10-h6 or 10.2.11 or later |
| 10.2.5 through 10.2.9 | Upgrade to 10.2.9-h13 or 10.2.11 or later | |
| 10.2.0 through 10.2.4 | Upgrade to 10.2.4-h25 or 10.2.11 or later | |
| PAN-OS 10.1 | 10.1.0 through 10.1.14 | Upgrade to 10.1.14-h11 or later |
| All other older unsupported PAN-OS versions | Upgrade to a supported fixed version. |
PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade from this EoL vulnerable version to a fixed version.
We proactively initiated an upgrade of Prisma Access on March 21, 2025, to cover all tenants.
Workarounds and Mitigations
This issue can be mitigated using a different form of authentication for the GlobalProtect portal (such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos). For more information about configuring authentication for the GlobalProtect portal see this technical documentation.
Acknowledgments
CPEs
cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:*:*:*:*:*:*:*