Overview
The GlobalProtect gateway and portal in Palo Alto Networks PAN-OS reflect part of the request URL into the page without encoding it. The flaw applies only to firewalls with a GlobalProtect gateway or portal enabled.
An attacker sends an authenticated Captive Portal user a crafted link, and JavaScript runs in that user's browser against the portal origin. Palo Alto says the integrity impact is limited to phishing and credential theft pages that appear to be hosted on the portal, with confidentiality exposure only where Clientless VPN is enabled. Fixes shipped in PAN-OS 11.2.7, 11.1.11 and 10.2.17.
Affected products
- PAN-OS 11.2 before 11.2.7
- PAN-OS 11.1 before 11.1.11
- PAN-OS 10.2 before 10.2.17
- PAN-OS 10.1, all versions
- Cloud NGFW and Prisma Access, per the vendor advisory
Disclosure timeline
- 14 May 2025
- Palo Alto Networks publishes CVE-2025-0133 and PAN-SA-2025-0005
- Jun to Aug 2025
- Fixed releases ship for PAN-OS 11.2, 11.1 and 10.2