CVE-2025-4227

GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement

State: Published
Severity: 1.0 Low
Published: Jun 13, 2025
Updated: Jun 23, 2025
Reserved: May 2, 2025

Description

An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel.

An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.

Scores

CVSS	Score	Vector	Source
4.0	1.0 Low	CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Green	palo_alto

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.2-566Affectedfrom 6.3.3-h1Not affectedfrom 6.3.2-566Not affected 6.2.0 to before 6.2.8-h2Affectedfrom 6.2.8-h2Not affected 6.1.0Affected 6.0.0Affected
GlobalProtect AppPalo Alto Networks	All to before 11.2.7Not affectedfrom 11.2.7Not affected

References

https://security.paloaltonetworks.com/CVE-2025-4227vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.