CVE-2025-4227lowCWE-319

CVE-2025-4227: low-severity vulnerability in Palo Alto Networks GlobalProtect App

GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement

Published · Updated

Follow this CVE+ Monitor GlobalProtect App

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 1epss 0.2%
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel. An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Green
Affected products
Palo Alto Networks · GlobalProtect App
Related CVEs — Palo Alto Networks GlobalProtect App

In the same product, most dangerous first.

CVE-2024-5921MEDIUMGlobalProtect App: Insufficient Certificate Validation Leads to Privilege EscalationEPSS 1.5%CVE-2021-3057HIGHGlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or GatewayEPSS 1.4%CVE-2020-2033MEDIUMGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookieEPSS 0.9%CVE-2022-0018MEDIUMGlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On EnabledEPSS 0.7%CVE-2026-0298MEDIUMGlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)EPSS 0.7%CVE-2026-0297MEDIUMGlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel HandshakeEPSS 0.6%