Palo Alto Networks PAN-OS security vulnerabilities

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the improper use of the AES-128-CCM algorithm could result in the transmission of unencrypted data...

Palo Alto Networks Cortex XDR Broker VM Code Injection Vulnerability

Palo Alto Networks Cortex XDR Broker VM is a secure virtual machine from Palo Alto Networks, Inc. that integrates with Cortex XDR to bridge the network and Cortex XDR. A security vulnerability exists in Palo Alto Networks Cortex XDR Broker VM that stems from a code injection could lead to the...

Palo Alto Networks PAN-OS security vulnerabilities

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from improper input neutralization could lead to administrator impersonation...

CVE-2025-0131: Incorrect Privilege Assignment

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However,...

Efficient Malicious UAV Detection Using Autoencoder-TSMamba Integration

Malicious Unmanned Aerial Vehicles UAVs present a significant threat to next-generation networks NGNs, posing risks such as unauthorized surveillance, data theft, and the delivery of hazardous materials. This paper proposes an integrated AE-classifier system to detect malicious UAVs. The proposed...

CVE-2025-0133: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The...

PT-2025-21199

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS affected versions not specified Description: A missing exception check in the software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets, causing the...

CVE-2025-0135: Incorrect Privilege Assignment

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected...

PT-2025-21211 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Broker Vm

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Broker VM affected versions not specified Description: A code injection issue allows an authenticated user to execute arbitrary code with root privileges on the host operating system running the Broker VM...

CVE-2025-0132: Missing Authentication for Critical Function

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue...

Palo Alto Networks PAN-OS 11.1.x < 11.1.6-h1 / 11.1.x < 11.1.7-h2 / 11.2.x < 11.2.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.6-h1 / 11.1.7-h2 or 11.2.x prior to 11.2.5. It is, therefore, affected by a vulnerability. A missing exception check in Palo Alto Networks PAN-OS software with the web proxy feature enabled allows an...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h14 / 10.2.x < 10.2.13 / 11.1.x < 11.1.8 / 11.2.x < 11.2.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h14, 10.2.x prior to 10.2.13, 11.1.x prior to 11.1.8, or 11.2.x prior to 11.2.5. It is, therefore, affected by a vulnerability. An improper input neutralization vulnerability in the management web...

Guardian Positioning System (GPS) for Location Based Services

Location-based service LBS applications proliferate and support transportation, entertainment, and more. Modern mobile platforms, with smartphones being a prominent example, rely on terrestrial and satellite infrastructures e.g., global navigation satellite system GNSS and crowdsourced Wi-Fi,...

PT-2025-21210

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS affected versions not specified Description A reflected cross-site scripting XSS issue exists in the GlobalProtect gateway and portal features. This flaw allows the execution of malicious JavaScript within the browser...

Palo Alto Networks GlobalProtect security vulnerability

Palo Alto Networks GlobalProtect is a suite of network protection software from Palo Alto Networks, USA. The software provides features such as firewall monitoring and threat prevention. A security vulnerability exists in Palo Alto Networks GlobalProtect, which stems from a potential elevation of...

Palo Alto Networks PAN-OS 10.2.x < 10.2.17 / 11.1.x < 11.1.11 / 11.2.x < 11.2.7 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.17, 11.1.x prior to 11.1.11, or 11.2.x prior to 11.2.7. It is, therefore, affected by a vulnerability. A reflected cross-site scripting XSS vulnerability in the GlobalProtect gateway and portal features of...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h14 / 10.2.x < 10.2.11 / 11.0.x < 11.0.7 / 11.1.x < 11.1.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h14, 10.2.x prior to 10.2.11, 11.0.x prior to 11.0.7, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability. Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks...

PT-2025-21208 · Palo Alto Networks +1 · Palo Alto Networks Globalprotect +1

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks GlobalProtect affected versions not specified Description: The issue is related to an incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtec...

CVE-2025-0137: Improper Neutralization of Script in Attributes in a Web Page

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the...

PT-2025-21209 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Broker Vm

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Broker VM affected versions not specified Description: A missing authentication issue allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to...