CVE-2025-4614 MEDIUM

CVE-2025-4614: PAN-OS: Session Token Disclosure Vulnerability

Vendor Palo Alto Networks
Product PAN-OS
Weakness CWE-497
Published October 9, 2025
Last update October 9, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber

What the vulnerability does

01Description

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked.   The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Key dates

02Disclosure timeline

October 9, 2025 CVE published
October 9, 2025 Record updated