CVE-2025-0133

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue exists in the GlobalProtect gateway and portal features. This flaw allows the execution of malicious JavaScript within the browser of an authenticated Captive Portal user who clicks a specially crafted link. The primary risk involves phishing attacks that can lead to credential theft, particularly when Clientless VPN is enabled. It is estimated that over 3 million services are potentially affected worldwide. The issue does not allow attackers to modify configurations or contents of the portal and gateways, nor does it impact the availability of GlobalProtect features.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable Clientless VPN to eliminate the risk of credential theft and confidentiality impact.