CVE-2025-4614

PAN-OS: Session Token Disclosure Vulnerability

State: Published
Severity: 4.8 Medium
Published: Oct 9, 2025
Updated: Oct 9, 2025
Reserved: May 12, 2025

Description

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber	palo_alto

Weaknesses

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Product	Versions
Cloud NGFWPalo Alto Networks	AllNot affected
PAN-OSPalo Alto Networks	12.1.0Not affected 11.2.0 to before 11.2.8Affectedfrom 11.2.8Not affected 11.1.0 to before 11.1.12Affectedfrom 11.1.12Not affected 10.2.0 to before 10.2.17Affectedfrom 10.2.17Not affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2025-4614vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.