Palo Alto Networks fixed multiple privilege escalation flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-4228 | An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root. NVD description · AI analysis pending | 4.6 | <1% | — | — | ||
| CVE-2025-4230 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability. NVD description · AI analysis pending | 8.4 | <1% | — | — | ||
| CVE-2025-4231 | A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability. NVD description · AI analysis pending | 8.6 | <1% |
| — | ||
| CVE-2025-4232 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrativ An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root. NVD description · AI analysis pending | 8.5 | <1% |
| — | ||
| CVE-2025-4233 | An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies. An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies. NVD description · AI analysis pending | 5.1 | <1% | — | — |
Full article325 words · extracted from securityaffairs.com · click to collapse
Palo Alto Networks addressed multiple vulnerabilities and included the latest Chrome patches in its solutions.
Palo Alto Networks fixed seven privilege escalation vulnerabilities and integrated the latest Chrome security patches into its products.
Palo Alto applied 11 Chrome fixes and patched CVE-2025-4233, a cache vulnerability impacting the Prisma Access Browser.
The most severe vulnerability, tracked as CVE-2025-4232 (CVSS score of 7.1), is an authenticated code injection through wildcard on macOS.
“An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.” reads the advisory.
The company also addressed a PAN-OS Authenticated Admin Command Injection Vulnerability, tracked as CVE-2025-4231 (CVSS score of 6.1), in the Management Web Interface.
The command injection flaw in Palo Alto Networks PAN-OS allows authenticated admins with web interface access to execute actions as root. The company states that Cloud NGFW and Prisma Access are unaffected.
Another issue fixed by the company is PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI that is tracked as CVE-2025-4230 (CVSS score of 5.7).
“A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI.The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.” reads the advisory. “Cloud NGFW and Prisma® Access are not affected by this vulnerability.”
The firm also fixed a PAN-OS flaw, tracked as CVE-2025-4228 (CVSS score 1.0) exposing unencrypted SD-WAN data and a Cortex XDR Broker VM bug that let attackers escalate privileges to root.
The security vendor is not aware of attacks in the wild exploiting any of these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, PAN-OS)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/179000/security/palo-alto-networks-fixed-multiple-privilege-escalation-flaws.html