CVE-2025-4614

MEDIUM EPSS 12.4%
Published Oct 9, 20258mo ago · Modified Jun 17, 20261w ago
4.8 CVSS 4.0
Medium
Find Similar
Published Oct 9, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago

Description

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked.   The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

CVSS Details

Base Score
4.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
12.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-497

Affected Products 15

VendorProductVersionRange
paloaltonetworkspan-os*≥10.2.0  –  <10.2.17
paloaltonetworkspan-os*≥11.1.0  –  <11.1.6
paloaltonetworkspan-os*≥11.2.0  –  <11.2.8
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any
paloaltonetworkspan-os11.1.6any

References 1

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.