Session Fixation Vulnerability in GlobalProtect by Palo Alto Networks

CVE-2025-0126

Summary

A session fixation vulnerability in GlobalProtect's SAML login allows attackers to impersonate legitimate users by tricking them into clicking a malicious link. Once exploited, the attacker can perform actions as the compromised user. It is important to note that the SAML login for the PAN-OS management interface remains unaffected by this issue. Furthermore, Cloud NGFW and all instances of Prisma Access have been proactively patched to prevent exploitation.

References