CVE-2025-0138lowCWE-613

CVE-2025-0138: low-severity vulnerability in Palo Alto Networks Prisma Cloud Compute Edition

Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface

Published 14 May 2025 · Updated 23 Jun 2025

Follow this CVE + Monitor Prisma Cloud Compute + Monitor Compute in Prisma Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2epss 0.4%

Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible to unauthorized access. Compute in Prisma Cloud Enterprise Edition is not affected by this issue.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

Affected products

Palo Alto Networks · Compute in Prisma Cloud Enterprise Edition Palo Alto Networks · Prisma Cloud Compute Edition

References

https://security.paloaltonetworks.com/CVE-2025-0138