CVE-2025-4235

An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration: * Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention under a Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions configuration. * Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.

• CWE-497

• https://security.paloaltonetworks.com/CVE-2025-4235

Published

Sep 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4229An information disclosure vulnerability in the SD-WAN featur…6
• CVE-2025-4230A command injection vulnerability in Palo Alto Networks PAN-…8.4
• CVE-2025-4231A command injection vulnerability in Palo Alto Networks PAN-…7.2
• CVE-2025-4232An improper neutralization of wildcards vulnerability in the…8.8
• CVE-2025-4233An insufficient implementation of cache vulnerability in Pal…5.1
• CVE-2025-4234A problem with the Palo Alto Networks Cortex XDR Microsoft 3…2.4
• CVE-2025-4236A vulnerability has been found in PCMan FTP Server 2.0.7 and…9.8
• CVE-2025-4237A vulnerability was found in PCMan FTP Server 2.0.7 and clas…9.8
• CVE-2025-4238A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4239A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4240A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
• CVE-2025-4241A vulnerability classified as critical has been found in PHP…9.8