CVE-2025-0133

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal. For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.

• CWE-79

• https://security.paloaltonetworks.com/CVE-2025-0133

Published

May 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0127A command injection vulnerability in Palo Alto Networks PAN-…7.1
• CVE-2025-0128A denial-of-service (DoS) vulnerability in the Simple Certif…8.7
• CVE-2025-0129An improper exception check in Palo Alto Networks Prisma Acc…9.3
• CVE-2025-0130A missing exception check in Palo Alto Networks PAN-OS® soft…7.5
• CVE-2025-0131An incorrect privilege management vulnerability in the OPSWA…7.1
• CVE-2025-0132A missing authentication vulnerability in Palo Alto Networks…6.9
• CVE-2025-0134A code injection vulnerability in the Palo Alto Networks Cor…6.5
• CVE-2025-0135An incorrect privilege assignment vulnerability in the Palo …3.3
• CVE-2025-0136Using the AES-128-CCM algorithm for IPSec on certain Palo Al…5.3
• CVE-2025-0137An improper input neutralization vulnerability in the manage…4.8
• CVE-2025-0138Web sessions in the web interface of Palo Alto Networks Pris…2
• CVE-2025-0139An incorrect privilege assignment vulnerability in Palo Alto…6.3