InfoSecBulletin Cybersecurity for mankind
Palo Alto Networks warns a reflected cross-site scripting (XSS) vulnerability, CVE-2025-0133, in the GlobalProtect gateway and portal features of its PAN-OS software. The flaw allows malicious JavaScript to run in the browsers of authenticated Captive Portal users when they click specific links.
Organizations using the Clientless VPN feature face a serious threat. While it has a low severity rating (CVSS Base Score 2.0) in default settings, the risk increases to MEDIUM (CVSS 5.5) when the Clientless VPN is active.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
This issue is applicable only to PAN-OS firewall configurations with an enabled GlobalProtect gateway or portal. Palo Alto Networks is not aware of any malicious exploitation of this issue.
Mitigation Strategies:
Organizations running vulnerable versions should implement one of several available mitigations:
Upgrade to patched versions when available:
PAN-OS 11.2: Version 11.2.7 or later (expected June 2025).
PAN-OS 11.1: Version 11.1.11 or later (expected July 2025).
PAN-OS 10.2: Version 10.2.17 or later (expected August 2025).
Enable Threat Prevention IDs 510003 and 510004 (introduced in Applications and Threats content version 8970) for customers with Threat Prevention subscriptions and consider disabling Clientless VPN functionality entirely.
