CVE-2025-0118: globalprotect — Fix

Description

A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.

Is your site exposed to CVE-2025-0118?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-618 CWE-618

Affected Products

Vendor	Product	Versions
paloaltonetworks	globalprotect	6.0.0 — 6.0.11
paloaltonetworks	globalprotect	6.1.0 — 6.1.6
paloaltonetworks	globalprotect	6.2.0 — 6.2.5
paloaltonetworks	globalprotect	6.3.0 — 6.3.3

References

Advisories & Patches

https://security.paloaltonetworks.com/CVE-2025-0118

Frequently Asked Questions

What is CVE-2025-0118? +

A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) platforms. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2025-0118? +

CVE-2025-0118 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-0118? +

CVE-2025-0118 affects products from paloaltonetworks, specifically: globalprotect. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-0118? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-3400 10.0

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS …

CVE-2026-0284 9.9

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated …

CVE-2024-5910 9.8

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for …

CVE-2024-0012 9.8

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web …

CVE-2026-0300 9.8

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows …

CVE-2025-0107 9.8

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as …

CVE-2025-0118